npm: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

npm: joi: quadratic-time split in string.email multiple: true allows denial of service vulnerability discovered by ? in WordPress npm joi versions = 17.1.1, 17.13.9...

npm: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

npm: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service vulnerability discovered by ? in WordPress npm content versions = 3.0.6, = 4.0.6...

npm: minimatch has potential denial of service via globparts amplification

npm: minimatch has potential denial of service via globparts amplification vulnerability discovered by ? in WordPress npm minimatch versions 11.0.1...

npm: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

npm: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal vulnerability discovered by ? in WordPress npm glob versions = 9.0.0, = 14.0.1...

npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer

npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

npm: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: TLS client crash when the server sends no certificate

npm: Forge: TLS client crash when the server sends no certificate vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: Regular expression denial of service in PEM decoding (pem.decode)

npm: Forge: Regular expression denial of service in PEM decoding pem.decode vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

npm: Forge: Denial of Service via infinite loop in BigInteger.modInverse with negative input incomplete fix of CVE-2026-33891 vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

npm: Forge: verifyCertificateChain removes trusted CA certificates with the same subject from the CA store vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: AES-GCM authentication bypass via unvalidated tagLength option

npm: Forge: AES-GCM authentication bypass via unvalidated tagLength option vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

npm: Forge: PKCS12 MAC forgery and constant-key PBE via zero iteration count vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

npm: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: Denial of service in TLS record processing via call stack exhaustion

npm: Forge: Denial of service in TLS record processing via call stack exhaustion vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

npm: Forge: X.509 basicConstraints bypass in verifyCertificateChain via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

npm: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

npm: Nuxt: Dot segments in the request path bypass server/middleware path checks and server route rules on page routes vulnerability discovered by ? in WordPress npm nuxt versions = 4.6.0, 4.6.3...

npm: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

npm: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects vulnerability discovered by ? in WordPress npm follow-redirects versions = 1.16.0, = 1.16.1...

npm: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

npm: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher vulnerability discovered by ? in WordPress npm signalk-server versions = 2.28.0-beta.2, 2.34.0...

npm: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

npm: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution vulnerability discovered by ? in WordPress npm signalk-server versions = 2.0.0, 2.34.0...

WordPress Meow Lightbox plugin <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin Meow Lightbox versions = 5.6.4...

WordPress Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Ninja Forms versions = 3.15.5...

WordPress CP Multi View Events Calendar plugin <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by mrglwglwgl in WordPress Plugin CP Multi View Event Calendar versions = 1.4.43...

WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin NextGEN Gallery versions = 4.5.4...

WordPress FV Flowplayer Video Player plugin <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin FV Flowplayer Video Player versions = 7.5.55.7212...

WordPress FV Flowplayer Video Player plugin <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin FV Flowplayer Video Player versions = 7.5.55.7212...

WordPress Avada | Website Builder For WordPress & WooCommerce theme <= 7.16.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Muhamad Visat in WordPress Theme Avada versions = 7.16.2...

WordPress FV Flowplayer Video Player plugin <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by satoshigpt2021-sketch in WordPress Plugin FV Flowplayer Video Player versions = 7.5.55.7212...

WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 4.4.1 - Authenticated (Custom+) Local File Inclusion vulnerability

Authenticated Custom+ Local File Inclusion vulnerability discovered by khanhnv in WordPress Plugin NextGEN Gallery versions = 4.4.1...

WordPress User Submitted Posts – Enable Users to Submit Posts from the Front End plugin <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin User Submitted Posts versions = 20260916...

WordPress W3 Total Cache plugin <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin W3 Total Cache versions = 2.10.7...

WordPress PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin PDF Invoice Builder for WooCommerce versions = 7.1.1...

WordPress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by rpgsec in WordPress Plugin WP ERP versions = 1.17.10...

WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by churchill11 in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions = 5.16.4...

WordPress Welcart e-Commerce plugin <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sawyer in WordPress Plugin Welcart e-Commerce versions = 2.12.5...

WordPress W3 Total Cache plugin <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin W3 Total Cache versions = 2.10.7...

WordPress Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kevin Whelan in WordPress Plugin Shield Security versions = 22.3.2...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification vulnerability

Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification vulnerability discovered by AlexHenry in WordPress Plugin Spectra versions = 2.20.4...

WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Kuba in WordPress Plugin Uncanny Toolkit for LearnDash versions = 3.8.2...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Kuba in WordPress Plugin WP User Frontend versions = 4.3.13...

WordPress Wp Social Login and Register Social Counter plugin <= 3.2.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Kumar Atul Mandarin21 in WordPress Plugin Wp Social versions = 3.2.2...

WordPress Content Pilot – Autoblogging & Affiliate Marketing Suite plugin <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin WP Content Pilot versions = 2.2.4...

WordPress easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin EasyJobs versions = 2.8.4...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.13 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Dthangws in WordPress Plugin WP User Frontend versions = 4.3.13...

WordPress Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin <= 4.1.1 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin WP Project Manager versions = 4.1.1...

WordPress Redux Framework plugin <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Kuba in WordPress Plugin Redux Framework versions = 4.5.15...

WordPress WPO365 | MICROSOFT 365 GRAPH MAILER plugin <= 6.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nick Verhelle Bulldawg in WordPress Plugin WPO365 | MICROSOFT 365 GRAPH MAILER versions = 6.2...

WordPress WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kuba in WordPress Plugin WP Data Access versions = 5.5.88...

WordPress SEOPress – AI SEO Plugin & On-site SEO plugin <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin SEOPress versions = 10.3...

WordPress WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden plugin <= 3.5.6 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin WP2LEADS versions = 3.5.6...

WordPress Rox Appointment Booking – Event, Calendar & Appointment Scheduling plugin <= 1.3.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Daryle Minor in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions = 1.3.1...