WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Product Feed Manager versions = 7.6.1...

WordPress ARforms plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam - Noventiq Vietnam in WordPress Plugin ARForms versions = 7.2.1...

WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BetterDocs versions = 4.6.2...

WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WordPress Social Login and Register versions = 7.8.0...

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AffiliateX versions = 2.3.5...

WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Abandoned Cart Lite for WooCommerce versions = 6.8.0...

WordPress SUMO Reward Points for WooCommerce plugin <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nguyen Cong Quang in WordPress Plugin SUMO Reward Points versions = 32.7.0...

WordPress FormCraft plugin <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam - Noventiq Vietnam in WordPress Plugin FormCraft 3 versions = 3.9.14...

WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.6 - Content Injection vulnerability

Content Injection vulnerability discovered by NosleeP++ in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.6...

WordPress AI Copilot – Content Generator plugin <= 1.5.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AIWU versions = 1.5.4...

WordPress Product Designer for WooCommerce WordPress | Lumise plugin <= 2.1.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by bashu - VN in WordPress Plugin Lumise Product Designer versions = 2.1.1...

WordPress MDJM Event Management plugin <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by moonge in WordPress Plugin Mobile DJ Manager versions = 1.7.8.4...

WordPress GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin <= 1.12.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin GoDAM versions = 1.12.2...

WordPress Customer Support Ticket System & Helpdesk plugin <= 6.0.5 - Unauthenticated Code Injection vulnerability

Unauthenticated Code Injection vulnerability discovered by theviper17y in WordPress Plugin WP Ticket Customer Service Software & Support Ticket System versions = 6.0.5...

WordPress WP Foodbakery plugin <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin FoodBakery versions = 4.9...

WordPress ProfileGrid plugin < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering vulnerability

Subscriber+ Cross-User Private Message Thread Deletion and Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ProfileGrid versions 5.9.9.7...

WordPress ProfileGrid plugin < 5.9.9.7 - Subscriber+ Premium License Tampering vulnerability

Subscriber+ Premium License Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ProfileGrid versions 5.9.9.7...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.9 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Ninja Forms versions = 3.14.9...

NPM: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

NPM: React Router: Open redirect via backslash in and useNavigate CVE-2025-68470 bypass vulnerability discovered by ? in WordPress Npm react-router versions = 6.0.0, 7.18.0...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router-dom versions = 6.30.2, = 6.30.4...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router versions = 7.9.6, = 7.12.0...

NPM: React Router: RSCErrorHandler Missing Protocol Validation (XSS)

NPM: React Router: RSCErrorHandler Missing Protocol Validation XSS vulnerability discovered by ? in WordPress Npm react-router versions = 7.11.0, 7.18.0...

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors in React Router SSR Hydration vulnerability discovered by ? in WordPress Npm react-router versions = 6.4.0, 7.18.0...

NPM: find-my-way: DDoS with HTTP2

NPM: find-my-way: DDoS with HTTP2 vulnerability discovered by ? in WordPress Npm find-my-way versions = 9.6.0...

WordPress SureDash – Community, Courses & Member Dashboard plugin <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin SureDash versions = 1.10.0...

WordPress Rich Showcase for Google Reviews plugin <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Rich Showcase for Google Reviews versions = 6.9.9...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Status Modification vulnerability discovered by gidget smith in WordPress Plugin Stripe For WooCommerce versions = 4.0.7...

WordPress Open User Map – Interactive Leaflet Maps plugin <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Open User Map versions = 1.4.45...

WordPress Fluent Support – Helpdesk & Customer Support Ticket System plugin <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Fluent Support versions = 2.3.0...

WordPress Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.11...

WordPress Cozy Blocks plugin <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.11...

WordPress Brands for WooCommerce plugin <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Brands for WooCommerce versions = 3.8.8...

WordPress Visualizer – Tables & Charts Manager with Built-in AI Generator plugin <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Visualizer versions = 4.0.5...

WordPress WP Hotel Booking plugin <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Hotel Booking versions = 2.3.2...

WordPress Easy Appointments plugin <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Connection Deletion vulnerability discovered by Vamshi Krishna Upadrasta in WordPress Plugin Easy Appointments versions = 3.12.27...

NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.11...

NPM: Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

NPM: Auth.js: Configuration errors can cause existence-based auth checks to fail open auth object populated with an error vulnerability discovered by ? in WordPress Npm next-auth versions = 5.0.0-beta.0, = 5.0.0-beta.31...

NPM: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NPM: Auth.js: getToken throws an uncaught exception on malformed Bearer authorization headers vulnerability discovered by ? in WordPress Npm next-auth versions = 4.0.6, = 4.24.14...

NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass vulnerability discovered by ? in WordPress Npm next-auth versions = 4.10.3, 4.24.15...

NPM: Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NPM: Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them vulnerability discovered by ? in WordPress Npm next-auth versions = 4.24.14...

WordPress Post Grid Gutenberg Blocks – PostX plugin <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin PostX versions = 5.0.32...

WordPress Participants Database plugin <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure vulnerability discovered by Robert Hartinger in WordPress Plugin Participants Database versions = 2.7.8.3...

WordPress MapSVG – Vector maps, Image maps, Google Maps plugin <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin MapSVG versions = 8.14.0...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin Kirki versions = 6.0.14...

WordPress Firelight Lightbox plugin <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM Cross-Site Scripting vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Firelight Lightbox versions = 2.3.20...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...

WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Thaer Assfour in WordPress Plugin AWP Classifieds versions = 4.4.7...

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Zainul Anwar Adi Putra in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...

WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Byteflows Travel & Hotel Booking versions = 1.0.0...