271429 matches found
EUVD-2026-52580
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...
CVE-2026-16623
The CVE concerns the Create Block WordPress plugin (before 2.10.0). It fails to properly escape user input when writing to a generated PHP pattern file, enabling a multisite subsite administrator—who has the gating capability for this action but lacks the PHP file editing capability—to inject and...
CVE-2026-16536
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 is affected by an unauthenticated Server-Side Request Forgery (SSRF) due to not validating a user-supplied URL before performing a server-side request (via the calendar_id flow). Root cause: absence of URL validation i...
EUVD-2026-52579
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
CVE-2026-16618
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
EUVD-2026-52578
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
CVE-2026-16618
The CVE concerns the WordPress plugin Improve SEO (version up to 2.0.11). The vulnerability arises from improper validation of uploaded files: the plugin checks only the file content type while saving the file with an attacker-supplied extension into a publicly accessible directory. This allows u...
NPM: Sequelize: SQL Injection (Oracle DB)
NPM: Sequelize: SQL Injection Oracle DB vulnerability discovered by ? in WordPress Npm sequelize versions 6.37.4...
NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.3.0...
NPM: undici vulnerable to downstream response desynchronization via retry interceptor
NPM: undici vulnerable to downstream response desynchronization via retry interceptor vulnerability discovered by ? in WordPress Npm undici versions 6.28.0...
NPM: Socket.IO: Zero-attachment Memory Exhaustion
NPM: Socket.IO: Zero-attachment Memory Exhaustion vulnerability discovered by ? in WordPress Npm socket.io-parser versions 3.3.6...
NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.22...
WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin EmbedPress versions = 4.5.6...
WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.13.1...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by TurboNexic in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.14...
WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin NextGEN Gallery versions = 4.2.3...
WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.0...
