npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects vulnerability discovered by ? in WordPress npm undici versions = 7.0.0, 7.30.1...

npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent vulnerability discovered by ? in WordPress npm undici versions = 4.0.0, 6.29.1...

npm: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

npm: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation vulnerability discovered by ? in WordPress npm undici versions = 4.2.1, 6.29.1...

npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering vulnerability discovered by ? in WordPress npm undici versions = 5.15.0, 6.29.1...

npm: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

npm: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor vulnerability discovered by ? in WordPress npm undici versions = 7.15.0, 7.30.1...

WordPress Pie Register Premium plugin <= 3.8.4.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Chu Thao Mai in WordPress Plugin Pie Register Premium versions = 3.8.4.0...

WordPress YOOtheme Pro theme 5.0.0-5.0.52 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by ? in WordPress Theme yootheme versions 5.0.0-5.0.52...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Ultimate Member versions = 2.14.0...

WordPress Document Embedder – let visitors read files without downloading plugin <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Document Embedder versions = 2.4.0...

WordPress Clean Login plugin <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Clean-Login Option Update vulnerability discovered by Wordfence PRISM in WordPress Plugin Clean Login versions = 1.20.1...

WordPress Jupiter X Core plugin <= 4.61.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by daroo in WordPress Plugin JupiterX Core versions = 4.61.0...

WordPress affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin affiliate-toolkit versions = 3.9.2...

WordPress Appointment Booking Calendar plugin <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Appointment Booking Calendar versions = 1.4.05...

WordPress Animated Text Block – Add Typing and Looping Text Effects plugin <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin Animated Text Block versions = 1.2.6...

npm: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

npm: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString DoS vulnerability discovered by ? in WordPress npm qs versions = 6.7.0, = 6.16.0...

npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake vulnerability discovered by ? in WordPress npm undici versions = 8.11.0, 8.11.2...

WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by wackydawg in WordPress Plugin Newsletters versions = 4.18.2...

WordPress AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion vulnerability

Authenticated Subscriber+ Limited Media File Deletion vulnerability discovered by Sawyer in WordPress Plugin AI Engine versions = 3.8.4...

WordPress affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin affiliate-toolkit versions = 3.9.2...

WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin AMP for WP versions = 1.1.17...

WordPress AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Michael Perla vizen5 in WordPress Plugin AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot versions = 1.2.8...

WordPress AI Alt Text Generator plugin <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'postid' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AI Alt Text Generator versions = 2.7.0...

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL vulnerability discovered by ? in WordPress npm better-auth versions = 1.6.17, 1.7.7...

npm: better-auth: OAuth Proxy lets an attacker sign in as another user

npm: better-auth: OAuth Proxy lets an attacker sign in as another user vulnerability discovered by ? in WordPress npm better-auth versions = 1.5.0-beta.12, 1.7.7...

npm: better-auth: OAuth state can be used as a Magic Link to sign in as another user

npm: better-auth: OAuth state can be used as a Magic Link to sign in as another user vulnerability discovered by ? in WordPress npm better-auth versions = 1.4.0-beta.18, 1.7.7...

npm: Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

npm: Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.12...

npm: Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

npm: Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.12...

npm: Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

npm: Nodemailer: Quadratic On^2 SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.9...

npm: better-auth: Device login approval does not show the requesting client or permissions

npm: better-auth: Device login approval does not show the requesting client or permissions vulnerability discovered by ? in WordPress npm better-auth versions = 1.3.8-beta.3, 1.7.0-rc.3...

npm: Satori-generated SVG has improper escaping

npm: Satori-generated SVG has improper escaping vulnerability discovered by ? in WordPress npm satori versions = 0.0.27, 0.33.5...

npm: Ghost: Authorization Bypass in Comment Like Feature

npm: Ghost: Authorization Bypass in Comment Like Feature vulnerability discovered by ? in WordPress npm ghost versions = 5.9.0, 6.44.1...

WordPress All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin All-in-One Video Gallery versions = 4.9.7...

npm: dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

npm: dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS vulnerability discovered by ? in WordPress npm dcmjs versions 0.52.0...

WordPress TiendaCrypto para WooCommerce plugin 1.0.1-1.2.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin TiendaCrypto para WooCommerce versions 1.0.1-1.2.1...

WordPress PayDunya WooCommerce Payment Gateway plugin <= 1.1.6 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PayDunya WooCommerce Payment Gateway versions = 1.1.6...

WordPress Payex Payment Gateway for Woocommerce plugin <= 1.2.10 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payex Payment Gateway for Woocommerce versions = 1.2.10...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability discovered by normaandersonfrank in WordPress Plugin ACF Extended versions = 0.9.2.6...

WordPress Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode plugin <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nguyen viet tin in WordPress Plugin Advanced Views versions = 3.9.6...

WordPress Analytics Insights – Google Analytics Dashboard for WordPress plugin <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by hei in WordPress Plugin Analytics Insights for Google Analytics versions = 6.3.12...

WordPress aBlocks plugin <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute vulnerability

Authenticated Contributor+ Privilege Escalation to 'roleSlug' Block Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin aBlocks versions = 2.17.0...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover vulnerability

Authenticated Subscriber+ PHP Object Injection to Administrator Account Takeover vulnerability discovered by daroo in WordPress Plugin Kirki versions = 6.2.5...

WordPress Qode Membership plugin <= 2.0.6.2 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by 0xwackydawg in WordPress Plugin Qode Membership versions = 2.0.6.2...

WordPress Payment Integration Wompi plugin <= 4.0.1 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Integration Wompi versions = 4.0.1...

WordPress Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Contributor+ PHP Object Injection to Remote Code Execution vulnerability discovered by moochi in WordPress Plugin Rank Math SEO versions = 1.0.276...

WordPress Jupiter X Core plugin <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin JupiterX Core versions = 4.61.0...

WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Gallery PhotoBlocks versions = 1.3.7...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability

Race Condition vulnerability discovered by Charles Vosburgh in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.31...

WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Arittro Sarkar in WordPress Plugin Customer Coupons for WooCommerce versions = 1.3.14...

WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Typing Text – Give your texts many typing effects versions = 2.2.0...

WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Button Block versions = 1.2.7...