NPM: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

NPM: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials vulnerability discovered by ? in WordPress Npm n8n versions 2.27.4...

NPM: n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

NPM: n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation vulnerability discovered by ? in WordPress Npm n8n versions 1.123.61...

NPM: n8n: External Secrets Permission Bypass via Expression Parser Mismatch

NPM: n8n: External Secrets Permission Bypass via Expression Parser Mismatch vulnerability discovered by ? in WordPress Npm n8n versions 1.123.61...

NPM: n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

NPM: n8n: Path-Confinement Bypass in computer-use searchfiles Allows Reading Files Outside the Base Directory vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

NPM: n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

NPM: n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Edit Image Node Format Injection Allows Arbitrary File Write

NPM: n8n: Edit Image Node Format Injection Allows Arbitrary File Write vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

NPM: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

NPM: n8n: Credential Authorization Bypass via Expression in HTTP Request Node genericAuthType vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Expression sandbox escape via arrow-function bodies enabling command execution

NPM: n8n: Expression sandbox escape via arrow-function bodies enabling command execution vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Authenticated code execution in the n8n Git node

NPM: n8n: Authenticated code execution in the n8n Git node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: SSRF Protection Bypass via MCP Client Node

NPM: n8n: SSRF Protection Bypass via MCP Client Node vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

NPM: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

NPM: n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

NPM: n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

NPM: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

NPM: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

NPM: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

NPM: n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

NPM: n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution vulnerability discovered by ? in WordPress Npm n8n versions 2.27.4...

NPM: n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

NPM: n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector vulnerability discovered by ? in WordPress Npm n8n versions 2.27.4...

NPM: n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

NPM: n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration vulnerability discovered by ? in WordPress Npm n8n versions 1.123.61...

NPM: n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

NPM: n8n: Shared Credential Header Leak via HTTP Request Pagination Expression vulnerability discovered by ? in WordPress Npm n8n versions 1.123.61...

WordPress Tickera – Sell Tickets & Manage Events plugin <= 3.6.0.1 - Authenticated (Staff+) SQL Injection vulnerability

Authenticated Staff+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tickera versions = 3.6.0.1...

WordPress Registrations for the Events Calendar – Event Registration Plugin plugin <= 3.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Registrations for the Events Calendar versions = 3.2...

WordPress Header Footer Script Adder plugin <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Header Footer Script Adder versions = 2.1...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.12...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Guillermo Álvarez in WordPress Plugin Shiptastic for WooCommerce versions = 5.1.0...

WordPress WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security plugin <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write vulnerability

Authenticated Administrator+ Arbitrary File Write vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content versions = 7.8.6.6...

WordPress WCPOS – Point of Sale (POS) plugin for WooCommerce plugin <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Shop Manager+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WooCommerce POS versions = 1.9.8...

WordPress Tickera – Sell Tickets & Manage Events plugin <= 3.6.0.1 - Authenticated (Staff+) SQL Injection vulnerability

Authenticated Staff+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Tickera versions = 3.6.0.1...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.0.4 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WPDM – Premium Packages versions = 7.0.4...

WordPress GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Viet Anh Ngo in WordPress Plugin GutenKit versions = 2.4.12...

WordPress Grid/List View for WooCommerce plugin <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Grid List View for WooCommerce versions = 3.0.9...

WordPress Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Accessibility Checker by Equalize Digital versions = 1.46.0...

WordPress Bulk Page Generator – LPagery plugin <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Bulk Landing Page Creator for WordPress LPagery versions = 2.5.7...

WordPress Brands for WooCommerce plugin <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting vulnerability

Authenticated Shop Manager+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Brands for WooCommerce versions = 3.8.8...

WordPress Brands for WooCommerce plugin <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Brands for WooCommerce versions = 3.8.8...

WordPress Webpushr plugin <= 4.41.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Webpushr versions = 4.41.0...

WordPress WP Shortcode by MyThemeShop plugin <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WP Shortcode by MyThemeShop versions = 1.4.17...

NPM: n8n: Google Service Account Private Key Exposed in JWT Header

NPM: n8n: Google Service Account Private Key Exposed in JWT Header vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

NPM: n8n: Stored DOM XSS via Resource Locator cachedResultUrl vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

NPM: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

NPM: n8n: AI Agents Project Viewer Privilege Escalation via runnodetool vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Tabs versions = 2.5...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...