WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability

Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.

WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.

WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.

WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.