NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used vulnerability discovered by ? in WordPress Npm next versions = 10.0.0, 15.5.24...

WordPress Jetpack plugin 14.5-16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters

Reflected to Stored Cross-Site Scripting via Reader Repost Parameters vulnerability discovered by Jetpack in WordPress Plugin Jetpack versions 16.1-16.1.2...

WordPress Greenshift plugin < 13.2.0 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Alireza Kalhor in WordPress Plugin Greenshift versions 13.2.0...

WordPress Eupago Gateway For Woocommerce plugin < 4.7.2 - Unauthenticated Arbitrary Refund Initiation vulnerability

Unauthenticated Arbitrary Refund Initiation vulnerability discovered by Pedro Pinho in WordPress Plugin Eupago Gateway For Woocommerce versions 4.7.2...

WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Son Bach & Lan Vy HPT Vietnam in WordPress Theme Aora versions = 1.3.19...

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Van Phuc in WordPress Plugin Flexible Subscriptions versions = 1.8.1...

WordPress Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin Easy Accordion versions = 3.1.8...

NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients vulnerability discovered by ? in WordPress Npm nuxt versions = 4.4.0, = 4.5.0...

WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by haofanjiukunle in WordPress Plugin Responsive Slider by MetaSlider versions = 3.111.0...

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.3...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress Cost Calculator Builder PRO plugin <= 4.0.3 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Cost Calculator Builder Pro versions = 4.0.3...

NPM: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

NPM: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection vulnerability discovered by ? in WordPress Npm tar versions = 7.5.20...

NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: SSRF Protection Bypass via MCP Client Node

NPM: n8n: SSRF Protection Bypass via MCP Client Node vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype

NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype vulnerability discovered by ? in WordPress Npm protobufjs versions = 8.2.0, = 8.6.4...

WordPress bbp style pack plugin <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin bbp style pack versions = 6.4.5...

WordPress KiviCare plugin <= 4.5.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by PRISM - Wordfence in WordPress Plugin KiviCare versions = 4.5.0...

WordPress Points and Rewards for WooCommerce plugin <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Latz in WordPress Plugin Points and Rewards for WooCommerce versions = 2.10.1...

WordPress Highlighting Code Block plugin <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Chinnapak Charoensiri in WordPress Plugin Highlighting Code Block versions = 2.2.0...

WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jamaal ahmed in WordPress Plugin Simple Business Directory Pro versions = 15.9.4...

WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Amelia versions = 2.4.2...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Taichi Kashimura in WordPress Plugin NEX-Forms versions = 9.2.2...

NPM: OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

NPM: OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

WordPress Upking - Hiking Club WordPress theme theme <= 1.4 - Broken Access Control vulnerability

WordPress Upking - Hiking Club WordPress theme theme = 1.4 - Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Upking - Hiking Club WordPress Theme versions = 1.4...

WordPress Ninja Forms - File Uploads plugin <= 3.3.29 - Unauthenticated Arbitrary File Read vulnerability

WordPress Ninja Forms - File Uploads plugin = 3.3.29 - Unauthenticated Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.29...

WordPress My Calendar – Accessible Event Manager plugin <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by ? in WordPress Plugin My Calendar versions = 3.7.14...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Group Creation/Modification vulnerability discovered by ? in WordPress Plugin JoomSport versions = 5.7.8...

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.21...

WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jakub Herman in WordPress Plugin ApplyOnline versions = 2.6.7.6...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.5 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by ? in WordPress Plugin SMS Alert Order Notifications versions = 3.9.5...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection vulnerability

Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin Contact Form by WPForms versions = 1.10.2...

WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Woffice versions 5.4.33...

WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Forget About Shortcode Buttons versions = 2.1.3...

WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Austin Ginder in WordPress Plugin GravityView versions = 3.0.0...

WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Contest Gallery versions = 30.0.0...

WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by hhhai in WordPress Plugin WP Job Portal versions = 2.5.2...

WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by William Matos in WordPress Plugin JS Help Desk versions = 3.1.0...

WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Mokksh Parekh in WordPress Plugin Advance Product Search versions = 1.4.4...

WordPress WP Forms Connector plugin <= 1.8 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by jamaal in WordPress Plugin WP Forms Connector versions = 1.8...

WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by nobody09 in WordPress Plugin User Registration versions = 5.2.2...

NPM: TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

NPM: TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy MySQL/MariaDB vulnerability discovered by ? in WordPress Npm typeorm versions = 0.1.12, = 0.3.28...

WordPress Paymob for WooCommerce plugin <= 4.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sajjad Haqi in WordPress Plugin Paymob for WooCommerce versions = 4.1.3...

NPM: OpenClaw: Active Memory write scope could mutate global config

NPM: OpenClaw: Active Memory write scope could mutate global config vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...

NPM: npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

NPM: npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation vulnerability discovered by ? in WordPress Npm praisonai versions = 1.5.1, = 1.7.1...

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Bundling vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.246.0...

WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by she11f in WordPress Plugin WooCommerce PDF Invoice Builder versions = 2.0.8...

WordPress Powerpack for LearnDash plugin < 1.3.0 - Unauthenticated Arbitrary Option Update vulnerability

Unauthenticated Arbitrary Option Update vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin PowerPack for LearnDash versions 1.3.0...

WordPress Magic Export & Import plugin < 1.2.0 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Hoang Phuong in WordPress Plugin Magic Export & Import versions 1.2.0...

WordPress Smart Slider 3 plugin <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Nguyen Khanh Hao in WordPress Plugin Smart Slider 3 versions = 3.5.1.36...