WordPress Zingiri Web Shop Plugin <= 2.4.0 - Multiple XSS Vulnerabilities

Zingiri Web Shop plugin is prone to multiple cross-site scripting vulnerabilities. After the malicious code posted up, Javascrip code inserted to database with "$POST'notes'" variable. When administrator wants to see list of ordered items list, Javascript codes will come from database and start...

WordPress BuddyPress Plugin 1.5.5 - Remote SQL Injection

Buddypress plugin is prone to Remote SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Integrator 1.32 - Cross Site Scripting

WordPress Integrator "redirectto" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress Recent Comments Plugin <= 2.0.6 - XSS

Because of this vulnerability in the core.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...

WordPress Pay with Tweet Plugin <= 1.1 - Multiple Vulnerabilities

WordPress Pay with Tweet plugin is prone to a blind SQL injection and XSS vulnerabilities. Solution Update the plugin...

WordPress TheCartPress Plugin 1.6 - Cross Site Scripting

WordPress TheCartPress plugin's "OptionsPostsList.php" is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can ste...

WordPress Advanced Text Widget Plugin 2.0 - Cross Site Scripting

WordPress Advanced Text Widget plugin's "page" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...

WordPress Black-LetterHead Theme 1.5 - Cross Site Scripting

WordPress Black-LetterHead theme's "index.php" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...

WordPress AllWebMenus Plugin 1.1.3 - Remote File Inclusion

AllWebMenus plugin is prone to remote file include vulnerability. It allows an attacker to include a remote file and get access to the server. Solution Update the plugin...

WordPress Crawl Rate Tracker Plugin <= 2.0.2 - SQL Injection

Crawl Rate Tracker plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress Global Content Blocks Plugin <= 1.2 - SQL Injection

This WordPress Global Content Blocks plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress <= 3.1.2 - Clickjacking Attacks

This WordPress version does not prevent rendering for admin or login pages inside a frame in a third-party HTML document. It allows the attackers to conduct clickjacking attacks via a crafted web site. Solution Update WordPress...

WordPress Related Posts Plugin <= 1.0 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities in the configuration screen in wp-relatedposts.php, the attackers can hijack the authentication of administrators for requests that insert cross-site scripting sequences. Solution Update the plugin...

WordPress Register Plus Plugin <= 3.5.1 - Multiple XSS

Because of these vulnerabilities in wp-login.php, the attackers can inject arbitrary web script or HTML via the "website", "aim", "yahoo", "jabber", "firstname", "lastname", "about", "pass1", and "pass2" parameters in a register action. Solution Update the plugin...

WordPress FeedList Plugin 2.61.01 - Cross-Site Scripting Vulnerability

This FeedList plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...

WordPress cache_lastpostdate - Arbitrary Code Execution

WordPress version prior to 1.5.1.3 is remotely exploitable if the web server on which it runs has registerglobals enabled in the PHP configuration. Perl code exists to automatically exploit vulnerable WP 1.5.1.3 sites, allowing the attacker to try to execute code. Solution Update WordPress...

WordPress WP-Cumulus <= 1.20 - Vulnerabilities

There are several vulnerabilities in this WordPress WP-Cumulus: cross-site scripting and full path disclosure vulnerabilities. Solution Update the WordPress...

WordPress WP-Cumulus Plugin 1.x - Cross-Site Scripting Vulnerability

WP-Cumulus plugin for WordPress is prone to a cross-site scripting vulnerability. It is caused by the application fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker...

WordPress Simple Forum Plugin - SQL Injection

Because of this vulnerability in ahah/sf-profile.php, the attackers can execute arbitrary SQL commands via the "u" parameter. Solution Update the plugin...

WordPress fMoblog Plugin 2.1 - SQL Injection Vulnerability

SQL injection vulnerability found in fmoblog.php. An attacker can execute arbitrary SQL commands via the id parameter to index.php. Solution Upgrade plugin...

WordPress Page Flip Image Gallery Plugin <= 0.2.2 - Directory Traversal

Because of this vulnerability, the attackers can read arbitrary files via "bookid" parameter. Solution Update the plugin...

WordPress WP Comment Remix Plugin <= 1.4.3 - XSS

Because of this vulnerability in wpcommentremix.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress MU <= 2.5 - XSS

Because of this vulnerability in wp-admin/wp-blogs.php, the attackers tcan inject arbitrary web script or HTML . Solution Update WordPress...

WordPress Newsletter Plugin - SQL Injection #1

Because of this vulnerability in stnliframe.php, the attackers can execute arbitrary SQL commands via the "newsletter" parameter. Solution Update the plugin...

WordPress Sniplets Plugin <= 1.2.2 - Remote File Inclusion

Because of this vulnerability in modules/syntaxhighlight.php, the attackers can execute arbitrary PHP code via a URL in the "libpath" parameter. Solution Update the plugin...

WordPress WP People Plugin <= 1.6.1 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "person" parameter. Solution Update the plugin...

WordPress <= 2.3.2 - Unauthorized Access Vulnerability

Because of this vulnerability, the attackers can edit posts of other blog users via unknown vectors. Solution Update WordPress...

WordPress Migration Plugin <= 1.0 - CSRF

Because of this vulnerability in deanspermalinksmigration.php, the attackers can modify the oldstructure configuration setting. Solution Update the plugin...

WordPress <= 2.0.3 - Directory Traversal

Because of this vulnerability in wp-db-backup.php, the attackers can read arbitrary files, delete arbitrary files, and cause a denial of service in the "backup" parameter. Solution Update WordPress...

WordPress Captcha Plugin <= 2.5 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress Cryptographp Plugin <= 1.2 - Multiple XSS

Because of these vulnerabilities in cryptographp/admin.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress MU <= 1.0 - XSS

Because of this vulnerability in wp-newblog.php, the attackers can inject arbitrary web script or HTML via the "weblogid" parameter. Solution Update WordPress...

WordPress Default Theme <= 2.2 - XSS

Because of this vulnerability, the authenticated administrators can inject arbitrary web script or HTML. Solution Update the theme...

WordPress WP Table Plugin <= 1.43 - Directory Traversal

Because of this vulnerability, the attackers can include and execute arbitrary local files via the "wpPATH" parameter. Solution Update the WordPress WP Table plugin to the latest available version at least 1.44...

WordPress wordTube Plugin <= 1.43 - Remote File Inclusion

Because of this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "wpPATH" parameter. Solution Update the WordPress wordTube plugin to the latest available version at least 1.44...

WordPress <= 2.1.1 - Multiple XSS

Because of these vulnerabilities in wp-includes/functions.php, the attackers can inject arbitrary web script or HTML. Solution Update the WordPress to the latest available version at least 2.1.2...

WordPress <= 2.1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "file" parameter. Solution Update the WordPress to the latest available version at least 2.1.1...

WordPress <= 1.5.1.2 - Multiple Vulnerabilities #2

Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to menu-header.php or a value in the "feed" parameter to wp-atom.php. Solution Update the Wordpress to the latest available version at least 1.5.1.3...

WordPress <=1.5 - Multiple Cross-Site Scripting (XSS) vulnerabilities

Because of these vulnerabilities in template-functions-post.php, attackers can execute arbitrary commands via the title of the post or content. Solution Update WordPress to the latest possible version...

NPM: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

NPM: Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.18.0...

NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...

WordPress WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection vulnerability

Unauthenticated Time-Based Blind SQL Injection vulnerability discovered by daroo in WordPress Plugin WordPress CTA versions = 2.2.2...

NPM: OpenClaw: Mattermost slash token revocation could lag until monitor refresh

NPM: OpenClaw: Mattermost slash token revocation could lag until monitor refresh vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.23...

NPM: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

NPM: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

NPM: Network-AI: EnvironmentManager.backup follows symlinked directories and copies files outside the environment root into backups vulnerability discovered by ? in WordPress Npm network-ai versions = 5.12.1...

NPM: Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

NPM: Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning vulnerability discovered by ? in WordPress Npm network-ai versions = 5.12.1...

NPM: npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

NPM: npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining vulnerability discovered by ? in WordPress Npm praisonai versions = 1.5.1, = 1.7.1...

NPM: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

NPM: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception vulnerability discovered by ? in WordPress Npm nodemailer versions = 8.0.7...

NPM: Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

NPM: Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPMCONFIGREGISTRY vulnerability discovered by ? in WordPress Npm esbuild versions = 0.17.0, 0.28.1...

WordPress Klamra Paycal for Aspaclaria plugin <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by KEVIN LEE crattack - OPCIA in WordPress Plugin Klamra Paycal for Aspaclaria versions = 1.1.4...