49933 matches found
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Johan Buenavida in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.17...
WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Booking and Rental Manager versions = 2.7.7...
WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin WPKoi Templates for Elementor versions = 3.7.2...
WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Agentimus – AI SEO, llms.txt & MCP for AI Agents versions = 1.51.0...
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.20...
WordPress Quick Event Manager plugin <= 9.18 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Quick Event Manager versions = 9.18...
WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by sungbyeongchan in WordPress Plugin BookIt versions = 2.6.0.3...
WordPress Quick Event Manager plugin <= 9.18 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by she11f in WordPress Plugin Quick Event Manager versions = 9.18...
WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by NamDang in WordPress Plugin Timetics versions = 1.0.61...
WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin JobSearch versions = 3.2.0...
WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by WiniS in WordPress Plugin Mail Mint versions = 1.31.0...
WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by endy in WordPress Plugin Mail Mint versions = 1.31.0...
WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin WPFunnels versions = 3.12.13...
WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by nh4tvd in WordPress Plugin Business Directory versions = 6.4.26...
WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentBooking Pro versions = 2.2.1...
WordPress Pre-Orders for WooCommerce plugin <= 2.3.1 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by MoonFuji in WordPress Plugin Pre-Orders for WooCommerce versions = 2.3.1...
WordPress WC Ukraine Shipping plugin <= 1.22.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WC Ukraine Shipping versions = 1.22.5...
WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by sungbyeongchan in WordPress Plugin Business Directory versions = 6.4.26...
WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Shared Files Pro versions 1.7.70...
WordPress Simple Ajax Chat plugin < 20260827 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Simple Ajax Chat versions 20260827...
WordPress FAQ Builder AYS plugin 1.6.3-1.8.4 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin FAQ Builder AYS versions 1.6.3-1.8.4...
WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability
Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...
WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...
WordPress Rank Math SEO plugin < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability
Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...
WordPress GamiPress plugin < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award vulnerability
Subscriber+ Arbitrary User Points and Achievement Award vulnerability discovered by Shivamani Vastrala in WordPress Plugin GamiPress versions 7.9.9.6...
WordPress Social Media Share Buttons & Social Sharing Icons plugin < 3.0.1 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Social Media & Share Icons versions 3.0.1...
WordPress Photo Gallery by 10Web plugin < 1.8.44 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Photo Gallery by 10Web versions 1.8.44...
WordPress JetBackup plugin 3.1.7.9-3.1.23.3 - Subscriber+ Privilege Escalation vulnerability
Subscriber+ Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Backup Guard versions 3.1.7.9-3.1.23.3...
WordPress Advanced Custom Fields: Extended plugin < 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability
Unauthenticated Administrator Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ACF Extended versions 0.9.2.7...
WordPress Advanced Custom Fields: Extended plugin 0.9.2.2-0.9.2.6 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.2-0.9.2.6...
WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Theme Enfold versions = 8.0...
WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification vulnerability
Missing Authorization to Unauthenticated JetEngine Options Page Modification vulnerability discovered by andrea bocchetti in WordPress Plugin JetFormBuilder versions = 3.6.2...
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 vulnerability discovered by ? in WordPress Npm link-preview-js versions = 4.0.3...
WordPress Divi theme <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions = 4.27.6...
WordPress GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin GutenKit versions = 2.4.4...
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.2, 2.4.5...
NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...
NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.1, 2.4.5...
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...
NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
NPM: fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count vulnerability discovered by ? in WordPress Npm fastify versions = 5.8.3, 5.12.1...
NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch
NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch vulnerability discovered by ? in WordPress Npm fastify versions 5.12.1...
NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.32.0...
NPM: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
NPM: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref vulnerability discovered by ? in WordPress Npm orval versions 8.22.0...
NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal
NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
NPM: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
NPM: Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
NPM: qs array-limit bypass via bracket-key comma parsing
NPM: qs array-limit bypass via bracket-key comma parsing vulnerability discovered by ? in WordPress Npm qs versions = 6.14.2, = 6.15.3...
NPM: qs: Denial of Service via Attacker Controlled isBuffer
NPM: qs: Denial of Service via Attacker Controlled isBuffer vulnerability discovered by ? in WordPress Npm qs versions = 2.2.5, 6.16.0...
NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...
NPM: pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
NPM: pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...