NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress Super Progressive Web Apps plugin <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by lucsob in WordPress Plugin Super Progressive Web Apps versions = 2.2.43...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

NPM: Flowise: DELETE /api/v1/chatflows/:id does not validate resource type, allowing agentflows:delete and chatflows:delete to delete each other’s flow type vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Exploit for Interpretation Conflict in Wordpress

wp2exp2026 🔥 WordPress All-in-One Exploit Framework — De...

WordPress Relevanssi – A Better Search plugin <= 4.27.1 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi versions = 4.27.1...

WordPress Relevanssi Premium – A Better Search plugin <= 2.30.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi Premium versions = 2.30.2...

NPM: Flowise RCE via SQLite Record Manager Node

NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via SQLite Record Manager Node

NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

NPM: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

WP Time Capsule Plugin - Remote Code Execution

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...

WordPress RevSlider - Remote Code Execution via File Upload

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpageid parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

NPM: Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

NPM: Flowise: Missing authorization on /api/v1/files allows low-privileged API keys to list and delete files across workspaces within the same organization vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...