WordPress <= 4.0.0 - SSRF

wp-includes/http.php in WordPress allows the attackers to conduct server-side request forgery attacks by referring to a 127.0.0.0/8 resource. Solution Update WordPress...

WordPress Pods Plugin <= 2.4 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that conduct cross-site scripting attacks via the "toggled" parameter in the pods-components page to wp-admin/admin.php, reset pod settings and data via the "podsreset" parameter in the...

WordPress <=3.9.1 - Multiple Vulnerabilities #1

wp-includes/pluggable.php does not use delimiters during concatenation of action values and uid values in CSRF tokens, that allows the attackers to bypass a CSRF protection mechanism via a brute-force attack. Related records:...

WordPress Tom M8te Plugin <= 1.5.3 - Local File Inclusion

Because of this vulnerability, the attackers can read arbitrary files via the "file" parameter to tom-download-file.php. Solution Upgrade the plugin...

WordPress Lazy SEO Plugin 1.1.9 - Shell Upload

This Lazy SEO plugin is prone to a shell upload vulnerability, in which the administrator or author could upload shell script, in the other words, default settings. Solution Update the plugin...

WordPress <= 3.6.0 - Cross Site Scripting #1

Because of this vulnerability, remote authenticated users can conduct cross-site scripting attacks. Solution Update WordPress...

WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #1

Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "sort" parameter. Solution Update the plugin...

WordPress WP125 Plugin <= 1.4.9 - CSRF

Because of this vulnerability in the adminmenus.php, the attackers can hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors. Solution Update the plugin...

WordPress <= 3.5.1 - Privilege Escalation

Because of this vulnerability, the authenticated users can bypass intended restrictions on publishing and authorship reassignment via unspecified vectors. Solution Update the plugin...

WordPress <= 3.5.1 - Full Path Disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the plugin...

WordPress ZeroClipboard Plugin <= 1.0.7 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter. Solution Update the plugin...

WordPress Mingle Forum Plugin <= 1.0.34 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests. Solution Update the plugin...

WordPress All Video Gallery Plugin 1.1 - SQL Injection Vulnerability

This WordPress All Video Gallery plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress <= 3.4.1 - Multiple vulnerabilities

Multiple vulnerabilities are in the wp-admin/plugins.php. Because of that, remote authenticated users can make unintended plugin changes by leveraging the Administrator role. Solution Update WordPress...

WordPress BulletProof Security Plugin <= .47.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the HTTPACCEPTENCODING header. Solution Update the plugin...

WordPress Zingiri Web Shop Plugin <= 2.3.9 - Multiple vulnerabilities

This plugin has unknown impact and attack vectors. Solution Update the plugin...

WordPress Organizer Plugin 1.2.1 - Multiple Security Vulnerabilities

WordPress Organizer plugin is prone to a cross-site scripting, information disclosure and directory-traversal vulnerabilities. These vulnerabilities allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the browser, also, disclose sensitive...

WordPress <= 3.4.0 - Multiple Vulnerabilities

Because of multiple vulnerabilities in this version of WordPress, remote authors or contributors can obtain sensitive information via unknown vectors. Solution Update WordPress...

WordPress <= 3.3.1 - XSS #2

The attackers can conduct cross-site scripting attacks via unspecified vectors, because of wp-includes/formatting.php in attempts to enable clickable links inside attributes. Solution Update WordPress...

WordPress Users Plugin <= 1.3 - SQL Injection

Because of this vulnerability in wp-users.php, the attackers can execute arbitrary SQL commands via the "uid" parameter to index.php. Solution Update the plugin...

WordPress WPtouch Plugin - SQL Injection Vulnerability

WPtouch plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Pixiv Custom Theme 2.1.5 - Cross Site Scripting

WordPress Pixiv Custom theme's "cpage" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress Symposium Plugin <= 11.12.07 - XSS

Because of this vulnerability in uploadify/getprofileavatar.php, the attackers can inject arbitrary web script or HTML via the "uid" parameter. Solution Update the plugin...

WordPress F8 Lite Theme 4.2.1 - Cross Site Scripting

WordPress F8 Lite theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...

WordPress FireStats Plugin <= 1.6.1 - Remote File Inclusion

Because of this vulnerability in firestats-wordpress.php, the attackers can execute arbitrary PHP code via a URL in the "fsjavascript" parameter. Solution Update the plugin...

WordPress <= 2.3.1 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "s" parameter. Solution Update WordPress...

WordPress <= 2.3 - XSS

Because of this vulnerability in wp-admin/edit-post-rows.php, the attackers can inject arbitrary web script or HTML via the "postscolumns" array parameter. Solution Update WordPress...

WordPress <= 2.0.1 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "useremail" parameter. Solution Update WordPress...

WordPress <= 2.2.1 - Multiple XSS

Because of these vulnerabilities, the authenticated administrators can inject arbitrary web script or HTML. Solution Update WordPress...

WordPress WP Table Plugin <= 1.43 - Remote File Inclusion

Because of this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "wpPATH" parameter. Solution Update the WordPress WP Table plugin to the latest available version at least 1.44...

WordPress <= 2.0.2 - Direct Static Code Injection

Because of this vulnerability, the attackers can execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, when it is appended after a special comment sequence into files. Solution Update the WordPress to the latest available version at least 2.0.3...

NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service

NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.1...

NPM: n8n: Expression sandbox escape via arrow-function bodies enabling command execution

NPM: n8n: Expression sandbox escape via arrow-function bodies enabling command execution vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits vulnerability discovered by ? in WordPress Npm fast-xml-parser versions = 5.9.3, 5.10.1...

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement vulnerability discovered by ? in WordPress Npm body-parser versions 1.20.6...

NPM: websocket-driver: Resource limit bypass via message compression

NPM: websocket-driver: Resource limit bypass via message compression vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/path — arbitrary host file read/write/delete vulnerability discovered by ? in WordPress Npm obsidian-local-rest-api versions 4.1.3...

WordPress Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates plugin <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Animation Addons for Elementor versions = 2.6.3...

WordPress CBX 5 Star Rating & Review plugin <= 1.0.7 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Julian Chibuike Nwadinobi Wackydawg - streamio in WordPress Plugin CBX 5 Star Rating & Review versions = 1.0.7...

NPM: Flowise has an MCP Security Bypass that Enables RCE

NPM: Flowise has an MCP Security Bypass that Enables RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.1...

NPM: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

NPM: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...

WordPress ilGhera Support System for WooCommerce plugin <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Woocommerce Support System versions = 1.3.0...

NPM: Next.js has a Denial of Service in the Image Optimization API

NPM: Next.js has a Denial of Service in the Image Optimization API vulnerability discovered by ? in WordPress Npm next versions = 10.0.0, 15.5.16...

NPM: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

NPM: vm2 has access to VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL vulnerability discovered by ? in WordPress Npm vm2 versions 3.11.2...

WordPress WP Responsive Recent Post Slider/Carousel plugin <= 3.7.1 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin WP Responsive Recent Post Slider/Carousel versions = 3.7.1...

WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin PDF Poster versions = 2.4.0...

WordPress Brookside theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Brookside versions = 1.4...

WordPress Appender plugin <= 1.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Appender versions = 1.1.1...

WordPress Flex Store Users plugin <= 1.1.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by シルAsuna in WordPress Plugin Flex Store Users versions = 1.1.0...

WordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Request a Quote versions = 2.5.3...