آخرین آسیب‌پذیری‌ها

Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`

WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail

Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript

Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement

WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter

User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter

SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag

Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log

WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name

Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter

Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action

Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter

Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache

VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter

Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter

WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter

PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout