npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

npm: systeminformation vulnerable to Windows command injection in services through Unicode quotation marks vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.16...

npm: Seroval: Code injection through a typed array's own constructor property

npm: Seroval: Code injection through a typed array's own constructor property vulnerability discovered by ? in WordPress npm seroval versions = 1.6.0, 1.6.11...

npm: Seroval: Script injection through RegExp sources in serialized output

npm: Seroval: Script injection through RegExp sources in serialized output vulnerability discovered by ? in WordPress npm seroval versions 1.0.0...

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS vulnerability discovered by ? in WordPress npm seroval versions = 1.6.7...

npm: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

npm: Seroval fromJSON/fromCrossJSON denial of service via unvalidated array node length vulnerability discovered by ? in WordPress npm seroval versions = 1.4.1, = 1.6.7...

npm: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

npm: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.onlistener without type check vulnerability discovered by ? in WordPress npm seroval versions = 1.6.7...

npm: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

npm: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key buildsessionscope vulnerability discovered by ? in WordPress npm mem0ai versions 3.1.6...

npm: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

npm: systeminformation has path traversal in Linux networkStats that allows symlink-based file disclosure outside /sys/class/net vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.14...

npm: systeminformation has prototype pollution in `networkStats()` via the interface name

npm: systeminformation has prototype pollution in networkStats via the interface name vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.13...

npm: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

npm: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service vulnerability discovered by ? in WordPress npm graphql-scalars versions = 2.0.0...

npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts lng in the query string vulnerability discovered by ? in WordPress npm i18next-http-backend versions 4.0.4...

npm: RE2JS: Quadratic-time denial of service in re2js lookbehind matching

npm: RE2JS: Quadratic-time denial of service in re2js lookbehind matching vulnerability discovered by ? in WordPress npm re2js versions = 2.2.0, 2.8.7...

npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places ns right after a / bypass of the // check added for GHSA-xvq9-wjp8-hwqf vulnerability discovered by ? in WordPress npm i18next-http-backend versions 4.0.3...

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.6...

npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

npm: Vue I18n: escapeParameter does not escape named values when the same call also passes a list vulnerability discovered by ? in WordPress npm vue-i18n versions = 9.0.0-beta.5, 11.4.14...

npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

npm: Vue I18n: escapeParameter does not escape named values when the same call also passes a list vulnerability discovered by ? in WordPress npm petite-vue-i18n versions = 9.2.0-alpha.7, 11.4.14...

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages vulnerability discovered by ? in WordPress npm petite-vue-i18n versions 9.14.5...

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages vulnerability discovered by ? in WordPress npm vue-i18n versions 9.14.5...

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.5...

npm: Highcharts: `javascript:` URL in credits.href runs script on click

npm: Highcharts: javascript: URL in credits.href runs script on click vulnerability discovered by ? in WordPress npm highcharts versions 11.4.9...

npm: Highcharts: dotted series.keys paths write to Object.prototype

npm: Highcharts: dotted series.keys paths write to Object.prototype vulnerability discovered by ? in WordPress npm highcharts versions = 6.1.0, 11.4.9...

npm: Highcharts: series column construction writes to Object.prototype

npm: Highcharts: series column construction writes to Object.prototype vulnerability discovered by ? in WordPress npm highcharts versions = 13.0.0, = 13.0.2...

npm: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

npm: Highcharts Core: breadcrumbs.style keys become SVG event-handler attributes vulnerability discovered by ? in WordPress npm highcharts versions = 10.0.0, 11.4.9...

npm: Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

npm: Highcharts Core: HTML text parsing falls back to unfiltered innerHTML during printing vulnerability discovered by ? in WordPress npm highcharts versions = 12.0.0, 12.6.1...

npm: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

npm: Highcharts Core: javascript: URL in an xlink:href attribute survives text filtering and reaches exported charts vulnerability discovered by ? in WordPress npm highcharts versions = 10.3.2, 11.4.9...

npm: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

npm: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 vulnerability discovered by ? in WordPress npm mcp-sanitizer versions 1.4.0...

npm: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

npm: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths vulnerability discovered by ? in WordPress npm mcp-sanitizer versions 1.4.0...

WordPress Password Protected – Protect Your Site Content With a Password plugin <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Password Protected versions = 2.8.4...

WordPress Schema App Structured Data plugin <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Schema App Structured Data versions = 2.3.2...

WordPress Core <= 7.1.3 - Unauthenticated Remote Code Execution via Core Update Race Condition

Unauthenticated Remote Code Execution via Core Update Race Condition vulnerability discovered by Umut Bayram in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Subscriber+ Stored Cross-Site Scripting via Multisite Network Users Screens

Subscriber+ Stored Cross-Site Scripting via Multisite Network Users Screens vulnerability discovered by Anthropic in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Unauthenticated Sensitive Data Exposure of Unpublished Customizer Changesets

Unauthenticated Sensitive Data Exposure of Unpublished Customizer Changesets vulnerability discovered by Antonio Lorensius Silaban in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Custom Role Broken Access Control to Post Notes

Custom Role Broken Access Control to Post Notes vulnerability discovered by Ramon in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Customizer Selective Refresh

Contributor+ Stored Cross-Site Scripting via Customizer Selective Refresh vulnerability discovered by Rafie Muhammad in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Block Delimiter Whitespace

Contributor+ Stored Cross-Site Scripting via Block Delimiter Whitespace vulnerability discovered by Rafie Muhammad in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Editor+ Stored Cross-Site Scripting via Personal Data Erasure Requests Screen

Editor+ Stored Cross-Site Scripting via Personal Data Erasure Requests Screen vulnerability discovered by Anthropic in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Interactivity API javascript: URLs

Contributor+ Stored Cross-Site Scripting via Interactivity API javascript: URLs vulnerability discovered by Luis Herranz in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Interactivity API Event Handler Bindings

Contributor+ Stored Cross-Site Scripting via Interactivity API Event Handler Bindings vulnerability discovered by Jon Surrell in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Interactivity API Context Prototype Pollution

Contributor+ Stored Cross-Site Scripting via Interactivity API Context Prototype Pollution vulnerability discovered by rekter0 in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Interactivity API Bindings

Contributor+ Stored Cross-Site Scripting via Interactivity API Bindings vulnerability discovered by rekter0, Marcel Karlsson, Alex Concha in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Denial of Service via Interactivity API Bindings

Contributor+ Denial of Service via Interactivity API Bindings vulnerability discovered by Jon Surrell in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Broken Access Control via Interactivity API Object Element Bindings

Contributor+ Broken Access Control via Interactivity API Object Element Bindings vulnerability discovered by rekter0 in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Author+ Stored Cross-Site Scripting via Interactivity Router Uploaded Files

Author+ Stored Cross-Site Scripting via Interactivity Router Uploaded Files vulnerability discovered by Anas cherni in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Script Module Data Shadowing

Contributor+ Stored Cross-Site Scripting via Script Module Data Shadowing vulnerability discovered by Weston Ruter in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Contributor+ Stored Cross-Site Scripting via Categories Block Format String

Contributor+ Stored Cross-Site Scripting via Categories Block Format String vulnerability discovered by Ben Bidner in WordPress core versions = 7.1.3...

WordPress Core <= 7.1.3 - Author+ Stored Cross-Site Scripting via Image and Playlist Block Insertion

Author+ Stored Cross-Site Scripting via Image and Playlist Block Insertion vulnerability discovered by Ben Bidner in WordPress core versions = 7.1.3...

WordPress DSGVO All in one for WP plugin <= 5.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin DSGVO All in one for WP versions = 5.0...

WordPress Blogroll Fun – Show Last Post and Last Update Time plugin < 0.8.5 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Anant Shrivastava in WordPress Plugin Blogroll Fun – Show Last Post and Last Update Time versions 0.8.5...

WordPress Issuu Panel plugin < 1.6.6 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by CrashBandicot in WordPress Plugin Issuu Panel versions 1.6.6...

WordPress diarise theme <= 1.5.9 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Felipe Andrian Peixoto in WordPress Theme Diarise versions = 1.5.9...