NPM: yayson: Prototype pollution in Store/LegacyStore deserialization

NPM: yayson: Prototype pollution in Store/LegacyStore deserialization vulnerability discovered by ? in WordPress Npm yayson versions = 4.2.0...

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix vulnerability discovered by ? in WordPress Npm mcp-from-openapi versions = 2.3.0, 2.5.0...

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix vulnerability discovered by ? in WordPress Npm frontmcp versions = 1.2.1, 1.5.0...

WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...

WordPress The Events Calendar plugin <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution vulnerability

Unauthenticated Code Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.3...

WordPress GEO my WP plugin <= 4.5.5.3 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by yck in WordPress Plugin GEO my WordPress versions = 4.5.5.3...

WordPress MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin <= 4.2.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nhien Pham nhienit nhienit, thevietronin in WordPress Plugin MPG versions = 4.2.1...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...

WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin bbPress versions = 2.6.14...

WordPress DT LMS – elearning, WordPress LMS Plugin plugin <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by adhikara13 in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.1...

WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by murloc.mrglwglwgl in WordPress Plugin ElasticPress versions = 5.3.4...

WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin Master Addons for Elementor versions = 3.2.2...

WordPress WP-Members Membership Plugin plugin <= 3.5.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WP-Members versions = 3.5.6...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

WordPress Gutenverse News plugin < 3.3.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons versions 3.3.3...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Store Owner+ Privilege Escalation to Administrator vulnerability

Store Owner+ Privilege Escalation to Administrator vulnerability discovered by Philipp Doblhofer in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

WordPress Visualizer plugin < 4.0.6 - Contributor+ Arbitrary Chart Deletion vulnerability

Contributor+ Arbitrary Chart Deletion vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Visualizer versions 4.0.6...

WordPress WPCafe plugin 3.0.10-3.0.17 - Unauthenticated Order Disclosure and Modification vulnerability

Unauthenticated Order Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin WPCafe versions 3.0.10-3.0.17...

WordPress Persian Elementor plugin 2.7.10-2.8.1 - Unauthenticated ZarinPal Payment Callback Authority Bypass vulnerability

Unauthenticated ZarinPal Payment Callback Authority Bypass vulnerability discovered by Artus KG in WordPress Plugin المنتور فارسی versions 2.7.10-2.8.1...

WordPress miniOrange 2FA plugin 18.0-19.2 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 5.3.24-6.3.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 5.3.24-6.3.0...

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

WordPress miniOrange 2FA plugin 18.0-19.2 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 6.2.8-6.3.0 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 6.2.8-6.3.0...

WordPress MetForm plugin < 4.1.9 - Unauthenticated Email Header Injection vulnerability

Unauthenticated Email Header Injection vulnerability discovered by Artus KG in WordPress Plugin Metform versions 4.1.9...

WordPress Payment Gateway PayPay for WooCommerce plugin 0.5-0.9.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Payment Gateway PayPay for WooCommerce versions 0.5-0.9.3...

WordPress Nexi XPay Build plugin 7.6.1-7.6.2 - Unauthenticated Saved Payment Token Disclosure vulnerability

Unauthenticated Saved Payment Token Disclosure vulnerability discovered by ryan fabella in WordPress Plugin Nexi XPay Build versions 7.6.1-7.6.2...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Kirki versions = 6.2.0...

WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...

WordPress HUSKY plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Kuba in WordPress Plugin HUSKY versions = 1.4.3...

WordPress CM HIPAA Forms plugin < 3.2.0 - Unauthenticated Authorization Bypass vulnerability

Unauthenticated Authorization Bypass vulnerability discovered by David Ballard in WordPress Plugin HIPAA FORMS versions 3.2.0...

WordPress SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin < 4.7.40 - Subscriber+ TLS Private Key Disclosure vulnerability

Subscriber+ TLS Private Key Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin SSL Zen versions 4.7.40...

WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...

WordPress Developer Tools plugin <= 1.1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Developer Tools versions = 1.1.3...

WordPress WP Express Checkout plugin < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment vulnerability

Unauthenticated Payment Bypass via wpecprocesspayment vulnerability discovered by Amity Gilmour in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.4.9...

WordPress All in One SEO plugin < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block vulnerability

Contributor+ Stored XSS via ai-assistant Block vulnerability discovered by Asaf Mozes in WordPress Plugin All In One SEO Pack versions 5.0.0.1...

WordPress Ultimate Gift Cards For WooCommerce plugin < 3.2.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Ultimate Gift Cards For WooCommerce versions 3.2.10...

WordPress RegistrationMagic plugin < 6.0.9.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Charles Vosburgh in WordPress Plugin RegistrationMagic versions 6.0.9.9...

WordPress Media LIbrary Assistant plugin <= 3.35 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by TruongLV1 From FPT Night Wolf - FPT Night Wolf in WordPress Plugin Media LIbrary Assistant versions = 3.35...

WordPress Themify - WooCommerce Product Filter plugin <= 1.5.5 - Reflected Cross-Site Scripting vulnerability

WordPress Themify - WooCommerce Product Filter plugin = 1.5.5 - Reflected Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Themify – WooCommerce Product Filter versions = 1.5.5...

WordPress Classified Listing plugin < 6.1.1 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Usama Arshad in WordPress Plugin Classified Listing versions 6.1.1...

WordPress Auto x LINE plugin <= 1.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Auto x LINE versions = 1.0.0...

WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...

WordPress Vigilant plugin <= 2.10.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sebastian Albrecht in WordPress Plugin Vigilant versions = 2.10.2...

WordPress zipMoney(Zip Co) Payments Plugin for WooCommerce plugin < 2.4.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin zipMoneyZip Co Payments Plugin for WooCommerce versions 2.4.0...

WordPress Simple Ajax Chat plugin <= 20260811 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HEI LAI SZE in WordPress Plugin Simple Ajax Chat versions = 20260811...

WordPress WP Photo Album Plus plugin <= 9.2.08.003 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WP Photo Album Plus versions = 9.2.08.003...