WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Afan in WordPress Plugin WP BASE Booking versions = 6.3.1...

WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin Reviewer versions = 3.14.2...

WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin Thrive Quiz Builder versions = 10.9.3.0...

WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin ListingPro versions = 2.9.10...

WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Tonda Core versions = 2.1.2...

WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Civi versions = 2.2.4...

WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by japaneseknotweed in WordPress Plugin WP-Polls versions = 2.77.3...

WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Advanced Views versions = 3.8.11...

WordPress HTML5 Video Player plugin <= 5.3.4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin HTML5 Video Player versions = 5.3.4.0...

WordPress Image&Video FullScreen Background plugin <= 1.6.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Image&Video FullScreen Background versions = 1.6.8...

WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by daroo in WordPress Plugin Kali Forms versions = 2.4.18...

WordPress Logos Showcase plugin <= 2.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Logos Showcase versions = 2.5...

WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Mitchell in WordPress Plugin Ziina versions = 1.2.21...

WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin Participants Database versions = 2.7.8.3...

WordPress PIMP - Creative MultiPurpose theme <= 1.7 - Cross Site Request Forgery (CSRF) vulnerability

WordPress PIMP - Creative MultiPurpose theme = 1.7 - Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme PIMP - Creative MultiPurpose versions = 1.7...

WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO in WordPress Plugin Mailster versions = 4.1.17...

WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by L4m in WordPress Plugin Participants Database versions = 2.7.8.3...

WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PayU India versions = 3.8.9...

WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by James Paremain in WordPress Plugin Easy Digital Downloads versions = 3.6.7...

WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Modula Image Gallery versions 2.14.25-2.14.30...

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Virtue/Ascend/Pinnacle Toolkit versions = 4.9.12...

WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ninja Tables versions = 5.2.10...

WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kit formerly ConvertKit versions = 3.3.5...

WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Luis Koleski in WordPress Plugin Avada Core versions = 5.15.6...

WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support versions = 2.3.0...

WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by z3r0s in WordPress Plugin AWP Classifieds versions = 4.4.7...

WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetBooking versions = 4.1.2...

WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetEngine versions = 3.8.11...

WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetBooking versions = 4.1.2...

WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetElements For Elementor versions = 2.9.1.1...

WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

WordPress Masteriyo - LMS plugin = 2.3.1 - Insecure Direct Object References IDOR vulnerability discovered by Celvex Group in WordPress Plugin Masteriyo - LMS versions = 2.3.1...

WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by jhhack in WordPress Plugin GiveWP versions = 4.16.3...

WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Uncanny Automator versions = 7.3.2...

WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Really Simple CSV Importer versions = 1.3...

WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Zarinpal Gateway versions = 5.1.0...

WordPress Polylang plugin <= 3.8.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang versions = 3.8.5...

WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ЮKassa для WooCommerce versions = 2.16.1...

WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Securepeak Research Team in WordPress Plugin MapSVG versions = 8.14.0...

WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Slider for WooCommerce versions = 1.13.62...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Ebook Store versions = 6.19...

WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by anhcd05 in WordPress Plugin Quiz And Survey Master versions = 11.2.0...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin Ebook Store versions = 6.19...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin MapSVG versions = 8.14.0...

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, = 2.4.2...

NPM: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

NPM: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 discovered by ? in WordPress Npm sharp versions 0.35.0...

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits vulnerability discovered by ? in WordPress Npm fast-xml-parser versions = 5.9.3, 5.10.1...

NPM: TypeORM: migration:generate template-literal code injection

NPM: TypeORM: migration:generate template-literal code injection vulnerability discovered by ? in WordPress Npm typeorm versions 0.3.31...

WordPress Ultimate Addons for Elementor plugin <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 2.9.1...