WordPress Pixiv Custom Theme 2.1.5 - Cross Site Scripting

WordPress Pixiv Custom theme's "cpage" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress AdRotate Plugin <= 3.6.5 - SQL Injection

AdRotate plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress <= 3.1.2 - Multiple vulnerabilities

Because of these vulnerabilities, the attackers can obtain sensitive data via vectors related to wp-includes/post.php. Solution Update WordPress...

WordPress <= 3.1.2 - SQL Injection

wp-includes/taxonomy.php has unknown impact and attack vectors, that possibly involving SQL injection. Solution Update WordPress...

WordPress <= 3.0.4 - Multiple Security Vulnerabilities

Because of these vulnerabilities, remote authenticated users can read draft posts or private posts via a modified "attachmentid" parameter. Solution Update WordPress...

WordPress Register Plus Plugin <= 3.5.1 - Multiple Vulnerabilities

Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to dashwidget.php and register-plus.php. Solution Update the plugin...

WordPress Embedded Video Plugin <= 4.1 - XSS

Because of this vulnerability in lembedded-video.php, the attackers can inject arbitrary web script or HTML via the "content" parameter to wp-admin/post.php. Solution Update the plugin...

WordPress <= 2.7.1 - Information Disclosure

Because of this vulnerability, the attackers can obtain sensitive information by reading the HTML source. Solution Update WordPress...

WordPress FireStats Plugin <= 1.6.1 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via unspecified vectors. Solution Update the plugin...

WordPress <= 2.3.2 - Multiple XSS vulnerabilities

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...

WordPress Footnotes Plugin <= 2.2 - Multiple XSS vulnerabilities

Because of these vulnerabilities in adminpanel.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress <= 2.0.9 - Multiple XSS

Because of these vulnerabilitie, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...

WordPress Captcha Plugin <= 2.5 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress BackUpWordPress Plugin <= 0.4.2 - Remote File Inclusion

Because og this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "bkpwppluginpath" parameter. Solution Update the plugin...

WordPress FeedBurner Plugin <= 2.2 - CSRF

Because of this vulnerability, the attackers can change settings and hijack blog feeds via a request to wp-admin/options-general.php. Solution Update the plugin...

WordPress <= 2.2.3 - XSS

The attackers can conduct cross-site scripting XSS attacks via modified data to post.php or page.php with a nofilter field. Solution Update WordPress...

WordPress Unnamed Theme <= 1.217 - XSS

Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the theme...

WordPress <= 2.2.1 - XSS

Because of this vulnerability in the wp-admin/includes/upload.php, the attackers can inject arbitrary web script or HTML via the "style" parameter. Solution Update WordPress...

WordPress <= 2.1.2 - Security BYPASS

The authenticated users with the contributor role can bypass intended access restrictions and invoke the publishposts functionality. Solution Update the WordPress to the latest available version at least 2.1.3...

WordPress <= 2.0.5 - Multiple vulnerabilities #1

Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request for wp-content/themes/default/index.php, links.php, sidebar.php, livejournal.php, hello.php, mt.php, page.php, rss.php, search.php, searchform.php, 404.php, wp-db-backup.php, akismet.php,...

WordPress <= 1.5.1.2 - Multiple XSS vulnerabilities

Because of these vulnerabilities in post.php, attackers can inject arbitrary web script or HTML via the "p" or "comment" parameter. Solution Update the WordPress to the latest available version at least 1.5.1.3...

WordPress <=1.5 - SQL injection vulnerability

Because of this vulnerability in wp-trackback.php, attackers can execute arbitrary SQL commands via the "tbid" parameter. Solution Update this plugin...

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor bypass of GHSA-j658-c2gf-x6pq fix vulnerability discovered by ? in WordPress Npm velocityjs versions = 2.1.6...

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/path — arbitrary host file read/write/delete vulnerability discovered by ? in WordPress Npm obsidian-local-rest-api versions 4.1.3...

NPM: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

NPM: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...

NPM: OpenClaw: Mattermost handlers could fall open when channel type was missing

NPM: OpenClaw: Mattermost handlers could fall open when channel type was missing vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...

WordPress Simple File List plugin <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action vulnerability

Missing Authorization to Unauthenticated File Modification via simplefilelisteditjob AJAX Action vulnerability discovered by WordFence in WordPress Plugin Simple File List versions = 6.3.7...

NPM: npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

NPM: npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation vulnerability discovered by ? in WordPress Npm praisonai versions = 1.5.1, = 1.7.1...

NPM: Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

NPM: Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads vulnerability discovered by ? in WordPress Npm multer versions = 2.0.0-alpha.1, 2.2.0...

WordPress Events Calendar for GeoDirectory plugin <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Mitchell in WordPress Plugin Events Calendar for GeoDirectory versions = 2.3.28...

WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin OttoKit versions = 1.1.27...

WordPress Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution vulnerability

Authenticated Contributor+ Remote Code Execution vulnerability discovered by kai63001 in WordPress Plugin Spectra versions = 2.19.25...

WordPress LiteSpeed Cache plugin <= 7.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin LiteSpeed Cache versions = 7.7...

WordPress Read More & Accordion plugin <= 3.5.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by BIMA IKHSAN in WordPress Plugin Read More & Accordion versions = 3.5.7...

WordPress WooCommerce PayPal Payments plugin <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure vulnerability

Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin WooCommerce PayPal Payments versions = 4.0.1...

WordPress Remove Yellow BGBOX plugin <= 1.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Remove Yellow BGBOX versions = 1.0...

WordPress Receive Notifications After Form Submitting – Form Notify for Any Forms plugin <= 1.1.10 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Receive Notifications After Form Submitting – Form Notify for Any Forms versions = 1.1.10...

WordPress Court Reservation – Manage Your Court Bookings Online plugin <= 1.10.11 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by MD. TAREQ AHAMED JONY itztrq - Knight Squad in WordPress Plugin Court Reservation versions = 1.10.11...

WordPress RTMKit plugin <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification vulnerability

Authenticated Author+ Missing Authorization to Widget Configuration Modification vulnerability discovered by momopon1415 in WordPress Plugin RTMKit versions = 2.0.2...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export vulnerability

Missing Authorization to Authenticated Subscriber+ Scheduled Form Submission Export vulnerability discovered by anhcd05 - VNPT Cyber Immunity in WordPress Plugin Forminator versions = 1.53.0...

WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Backup Schedule Creation and Backup File Download vulnerability discovered by Sélim Lanouar whattheslime in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.83...

NPM: VM2 Has a Sandbox Escape Issue via SuppressedError

NPM: VM2 Has a Sandbox Escape Issue via SuppressedError vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.4...

WordPress WP Lightbox 2 plugin < 3.0.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin WP Lightbox 2 versions 3.0.7...

WordPress ARForms plugin <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution vulnerability

Unauthenticated Blind Arbitrary Shortcode Execution vulnerability discovered by Krzysztof Zając - CERT PL in WordPress Plugin ARForms Form Builder versions = 1.7.2...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dragonzen in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Theme VW Portfolio versions = 1.3.3...

WordPress Filr - Secure document library plugin <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload vulnerability

WordPress Filr - Secure document library plugin = 1.2.11 - Authenticated Administrator+ Stored Cross-Site Scripting via HTML Upload vulnerability discovered by Phap Nguyen Anh - FIS in WordPress Plugin Filr versions = 1.2.11...

WordPress Dashboard Beacon plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HunSec in WordPress Plugin Dashboard Beacon versions = 1.2.0...

WordPress WPMasterToolKit (WPMTK) plugin <= 2.13.0 - Authenticated (Author+) Code Injection vulnerability

Authenticated Author+ Code Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WPMasterToolKit versions = 2.13.0...