WordPress <= 2.2.3 - XSS

The attackers can conduct cross-site scripting XSS attacks via modified data to post.php or page.php with a nofilter field. Solution Update WordPress...

WordPress wordTube Plugin <= 1.43 - Remote File Inclusion

Because of this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "wpPATH" parameter. Solution Update the WordPress wordTube plugin to the latest available version at least 1.44...

WordPress myGallery Plugin <= 1.4 - Remote File Inclusion

Because of this vulnerability in myfunctions/mygallerybrowser.php, the attackers can execute arbitrary PHP code via a URL in the "myPath" parameter. Solution Update the WordPress myGallery plugin to the latest available version at least 1.5...

WordPress <= 2.1.2 - Security BYPASS

The authenticated users with the contributor role can bypass intended access restrictions and invoke the publishposts functionality. Solution Update the WordPress to the latest available version at least 2.1.3...

WordPress <= 1.5.1 - Multiple Vulnerabilities

Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to wp-admin/upgrade-functions.php, wp-includes/vars.php, wp-admin/edit-form.php, wp-content/plugins/hello.php, wp-settings.php or wp-admin/edit-form-comment.php. Solution Update the WordPress to...

WordPress <= 1.5.1.2 - Multiple XSS vulnerabilities

Because of these vulnerabilities in post.php, attackers can inject arbitrary web script or HTML via the "p" or "comment" parameter. Solution Update the WordPress to the latest available version at least 1.5.1.3...

WordPress <=1.5 - SQL injection vulnerability

Because of this vulnerability, attackers can obtain sensitive information. Solution Update WordPress to the latest possible version...

WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Premium Addons for Elementor versions = 4.11.105...

WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin Flexible PDF Coupons versions = 1.14.11...

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Virtue/Ascend/Pinnacle Toolkit versions = 4.9.12.1...

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rully Miftahur Rozaq in WordPress Plugin Strong Testimonials versions = 3.3.11...

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab vulnerability discovered by ? in WordPress Npm electron versions 41.10.4...

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Estatik versions = 4.3.5...

WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.5...

WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ocean Extra versions = 2.6.1...

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate FAQ versions = 2.4.14...

WordPress Brevo – Email, SMS, Web Push, Chat, and more. plugin <= 3.1.77 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin Brevo versions = 3.1.77...

WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Son Bach & Lan Vy HPT Vietnam in WordPress Theme Aora versions = 1.3.19...

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Van Phuc in WordPress Plugin Flexible Subscriptions versions = 1.8.1...

WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

Path Traversal vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.3...

WordPress Super Progressive Web Apps plugin <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by lucsob in WordPress Plugin Super Progressive Web Apps versions = 2.2.43...

NPM: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

NPM: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks vulnerability discovered by ? in WordPress Npm ip-address versions = 10.1.1, = 10.2.1...

NPM: Trix: Stored XSS via HTMLParser attribute injection on paste

NPM: Trix: Stored XSS via HTMLParser attribute injection on paste vulnerability discovered by ? in WordPress Npm trix versions 2.1.18...

NPM: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

NPM: Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.18.0...

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...

NPM: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

NPM: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode vulnerability discovered by ? in WordPress Npm n8n-mcp versions = 2.57.3...

WordPress Cost Calculator Builder plugin <= 4.0.11 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by oper999 in WordPress Plugin Cost Calculator Builder versions = 4.0.11...

WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Plugin MStore API versions = 4.18.4...

NPM: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

NPM: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

WordPress My Calendar – Accessible Event Manager plugin <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by ? in WordPress Plugin My Calendar versions = 3.7.14...

WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jakub Herman in WordPress Plugin ApplyOnline versions = 2.6.7.6...

WordPress WP-BusinessDirectory – Business directory plugin for WordPress plugin <= 4.0.1 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin WP-BusinessDirectory versions = 4.0.1...

WordPress Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin <= 5.0.8 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin Taskbuilder versions = 5.0.8...

WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Werkstatt versions = 4.7.2...

WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by hhhai in WordPress Plugin WP Job Portal versions = 2.5.2...

WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass vulnerability

Missing Authorization to Unauthenticated Payment Bypass vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin User Registration versions = 5.2.0...

WordPress WP Forms Connector plugin <= 1.8 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by jamaal in WordPress Plugin WP Forms Connector versions = 1.8...

WordPress Themify Event Post plugin <= 1.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Themify Event Post versions = 1.3.3...

WordPress Simple File List plugin <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary File Operations Deletion / Move / Folder Creation / Download via 'frontmanage' Shortcode Attribute vulnerability discovered by WordFence in WordPress Plugin Simple File List versions = 6.3.7...

WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.8.7 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Lucius-log in WordPress Plugin Bit Integrations versions = 2.8.7...

WordPress Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin myCred versions = 3.1...

NPM: DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

NPM: DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULTALLOWEDTAGS / DEFAULTALLOWEDATTR vulnerability discovered by ? in WordPress Npm dompurify versions 3.4.7...

WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Fusion Builder versions = 3.15.4...

WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by she11f in WordPress Plugin WooCommerce PDF Invoice Builder versions = 2.0.8...

WordPress Spam protection, Honeypot, Anti-Spam by CleanTalk plugin < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass vulnerability

Unauthenticated Stored XSS via Comment Shortcode Bypass vulnerability discovered by Matthew Rollings in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions 6.79...

WordPress Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin Unlimited Elementor Inner Sections By BoomDevs versions = 1.3.3...

WordPress WP-Ultimate-Map plugin <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Muhammad Nur Ibnu Hubab - Pondok Teknologi in WordPress Plugin WP-Ultimate-Map versions = 1.1...

WordPress Accordions plugin <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Accordion versions = 2.3.23...