NPM: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

NPM: Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file vulnerability discovered by ? in WordPress Npm vite-plus versions = 1.0.0-rc.0, 1.3.0...

NPM: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

NPM: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs vulnerability discovered by ? in WordPress Npm openclaw versions 2026.6.6...

WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Oly Hossen in WordPress Plugin Tailored Tools versions = 3.0.3...

WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by dcs in WordPress Plugin H5P versions = 1.17.9...

WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin eRoom versions = 1.7.1...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Permission Model Bypass via fs.realpathSync() Path Probing

Permission Model Bypass via fs.realpathSync Path Probing vulnerability discovered by 0xoroot in WordPress Npm Node.js versions 22.23.4...

Node.js 26.0.0-26.12.0 - Permission Model Filesystem Over-Grant via Wildcard Radix Tree Lookup

Permission Model Filesystem Over-Grant via Wildcard Radix Tree Lookup vulnerability discovered by malikhamzaiqbal in WordPress Npm Node.js versions 26.0.0-26.12.0...

Node.js 26.0.0-26.12.0 - Exposure of Sensitive Information via Cached Invalid ZIP Local Headers

Exposure of Sensitive Information via Cached Invalid ZIP Local Headers vulnerability discovered by startimeash in WordPress Npm Node.js versions 26.0.0-26.12.0...

NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites vulnerability discovered by ? in WordPress Npm storybook versions = 8.0.0, 8.6.19...

NPM: Electron: HID and USB permission checks can be attributed to the wrong origin

NPM: Electron: HID and USB permission checks can be attributed to the wrong origin vulnerability discovered by ? in WordPress Npm electron versions 42.11.3...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Improper Certificate Validation for Non-Canonical IPv4 Hostnames

Improper Certificate Validation for Non-Canonical IPv4 Hostnames vulnerability discovered by br41ny in WordPress Npm Node.js versions 22.23.4...

NPM: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

NPM: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - HTTP Response Desynchronization on Pooled Keep-Alive Sockets

HTTP Response Desynchronization on Pooled Keep-Alive Sockets vulnerability discovered by hasanfleyah in WordPress Npm Node.js versions 22.23.4...

NPM: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

NPM: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

NPM: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

NPM: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Out-of-Bounds Write in the Bundled Brotli Decoder leading to Remote Code Execution

Out-of-Bounds Write in the Bundled Brotli Decoder leading to Remote Code Execution vulnerability discovered by Matteo Collina in WordPress Npm Node.js versions 22.23.4...

NPM: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

NPM: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Improper Certificate Validation via Non-Canonical IP Hostnames

Improper Certificate Validation via Non-Canonical IP Hostnames vulnerability discovered by anagnorisis2peripeteia in WordPress Npm Node.js versions 22.23.4...

Node.js < 24.22.1, < 26.12.1 - Improper Certificate Validation via Fullwidth-Digit IP Hostnames (checkServerIdentity bypass)

Improper Certificate Validation via Fullwidth-Digit IP Hostnames checkServerIdentity bypass vulnerability discovered by hasanfleyah in WordPress Npm Node.js versions 24.22.1...

NPM: ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

NPM: ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb/hsl prefix vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

NPM: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

NPM: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe stack overflow, nestingLimit not enforced vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.18.0, 2.18.1...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Improper Null Termination in dns.resolve() leading to Hostname Spoofing

Improper Null Termination in dns.resolve leading to Hostname Spoofing vulnerability discovered by hasanfleyah in WordPress Npm Node.js versions 22.23.4...

NPM: ApostropheCMS: Import API bypasses publication roles for protected content

NPM: ApostropheCMS: Import API bypasses publication roles for protected content vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Use of Insufficiently Random Values via Entropy Caches Retained in Startup Snapshots and SEAs

Use of Insufficiently Random Values via Entropy Caches Retained in Startup Snapshots and SEAs vulnerability discovered by gesposito in WordPress Npm Node.js versions 22.23.4...

NPM: Vite: Cross origin script execution through Vite custom middleware

NPM: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress Npm vite-plus versions = 1.0.0...

NPM: Vite: Cross origin script execution through Vite custom middleware

NPM: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress Npm vite versions = 6.4.3...

NPM: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

NPM: Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine vulnerability discovered by ? in WordPress Npm vite-plus versions = 1.0.0...

NPM: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

NPM: Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine vulnerability discovered by ? in WordPress Npm vite versions = 6.4.3...

NPM: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

NPM: Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance vulnerability discovered by ? in WordPress Npm vite versions = 8.2.0, = 8.2.3...

NPM: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

NPM: Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.2.8, = 1.0.0...

WordPress Cart Abandonment Recovery for WooCommerce plugin < 2.2.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Usama Arshad in WordPress Plugin WooCommerce Cart Abandonment Recovery versions 2.2.0...

WordPress LatePoint plugin < 5.7.5 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Filip Kowalski in WordPress Plugin LatePoint versions 5.7.5...

WordPress Simple Shopping Cart plugin < 5.3.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Simple Shopping Cart versions 5.3.3...

WordPress CMP – Coming Soon & Maintenance plugin 4.1.19-4.1.20 - Unauthenticated Maintenance Mode Bypass vulnerability

Unauthenticated Maintenance Mode Bypass vulnerability discovered by Sanjeev Kumar in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.19-4.1.20...

WordPress Wava Payment Plugin plugin 0.3.1-0.3.9 - Unauthenticated Merchant Credential Overwrite vulnerability

Unauthenticated Merchant Credential Overwrite vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Wava Payment versions 0.3.1-0.3.9...

WordPress WholesaleX plugin < 3.0.9 - Unauthenticated Imported User CSV Disclosure vulnerability

Unauthenticated Imported User CSV Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WholesaleX versions 3.0.9...

WordPress User Profile Builder plugin < 4.0.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by 0xBassia in WordPress Plugin Profile Builder versions 4.0.1...

WordPress Redirection for Contact Form 7 plugin 2.2.7-3.2.11 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Redirection for Contact Form 7 versions 2.2.7-3.2.11...

WordPress WP Booking System plugin < 2.1.0.3 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Zahid Abbasi in WordPress Plugin WP Booking System versions 2.1.0.3...

NPM: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

NPM: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export vulnerability discovered by ? in WordPress Npm apostrophe versions 4.33.0...

WordPress SmartyParcel plugin < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion vulnerability

Subscriber+ Arbitrary Shipping Label Deletion vulnerability discovered by Andy Urlep in WordPress Plugin WC Ukraine Shipping versions 1.23.4...

WordPress Simple Banner plugin < 3.3.3 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Simple Banner versions 3.3.3...

WordPress Moloni plugin < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation vulnerability

Subscriber+ Arbitrary Order Invoice Generation vulnerability discovered by Seongwon LEE in WordPress Plugin Moloni versions 5.0.14...

WordPress Ettrick Escape Room Booking plugin < 1.3.1 - Unauthenticated Payment Confirmation Bypass vulnerability

Unauthenticated Payment Confirmation Bypass vulnerability discovered by ryan fabella in WordPress Plugin Ettrick Escape Room Booking versions 1.3.1...

WordPress Falang multilanguage for WordPress plugin < 1.4.6 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Seongwon Lee in WordPress Plugin Falang multilanguage versions 1.4.6...

WordPress Synchrony Financing plugin 1.0.5-1.1.1 - Unauthenticated Order Takeover vulnerability

Unauthenticated Order Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Synchrony Financing versions 1.0.5-1.1.1...

WordPress Click n Chat (Chat Widget Integration) plugin 1.0.4-1.1.2 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Click n Chat Chat Widget Integration versions 1.0.4-1.1.2...

WordPress Click n Chat (Chat Widget Integration) plugin < 1.1.3 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Ryan Fabella in WordPress Plugin Click n Chat Chat Widget Integration versions 1.1.3...

WordPress WholesaleX plugin < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass vulnerability

Unauthenticated Account Activation and Administrator Approval Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WholesaleX versions 3.0.9...

WordPress Backup and Staging by WP Time Capsule plugin < 1.22.28 - Subscriber+ Staging-to-Live Deployment vulnerability

Subscriber+ Staging-to-Live Deployment vulnerability discovered by Het Kalariya in WordPress Plugin Backup and Staging by WP Time Capsule versions 1.22.28...