47760 matches found
WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin AffiliateWP versions = 2.34.0...
WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by dodoh4t in WordPress Plugin WP EasyPay versions = 4.5.0...
WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Photography versions = 5.7.8...
WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Riyas M S in WordPress Plugin Knit Pay versions = 9.6.0.0...
WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by dutafi in WordPress Plugin Broadcast Live Video versions = 7.2.4...
WordPress Easy Form Builder by WhiteStudio – Drag & Drop Form Builder plugin <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator vulnerability
Unauthenticated Privilege Escalation to Administrator vulnerability discovered by ? in WordPress Plugin Easy Form Builder versions = 4.0.11...
NPM: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
NPM: Astro: composable astro/hono pipeline bypasses security.checkOrigin when middleware is absent or misordered vulnerability discovered by ? in WordPress Npm astro versions = 7.0.0, 7.0.6...
NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement vulnerability discovered by ? in WordPress Npm body-parser versions 1.20.6...
NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement incomplete fix for CVE-2026-54298 vulnerability discovered by ? in WordPress Npm astro versions 7.0.6...
NPM: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
NPM: Astro: Cross-site scripting via unescaped transition: directive values on hydrated islands vulnerability discovered by ? in WordPress Npm astro versions = 3.10.0, 7.0.4...
NPM: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
NPM: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning vulnerability discovered by ? in WordPress Npm axios versions = 0.31.1, 0.33.0...
NPM: Axios form serializer maxDepth bypass via {} metatoken
NPM: Axios form serializer maxDepth bypass via metatoken vulnerability discovered by ? in WordPress Npm axios versions = 0.31.1, 0.33.0...
NPM: Axios: Nested axios option objects can consume polluted prototype values
NPM: Axios: Nested axios option objects can consume polluted prototype values vulnerability discovered by ? in WordPress Npm axios versions = 0.8.0, 0.33.0...
NPM: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
NPM: Axios: HTTP/2 streamed uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.18.0...
NPM: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
NPM: Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.18.0...
NPM: Axios: Prototype pollution gadgets can alter axios request construction
NPM: Axios: Prototype pollution gadgets can alter axios request construction vulnerability discovered by ? in WordPress Npm axios versions 0.33.0...
NPM: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
NPM: Axios: NOPROXY bypass for 0.0.0.0 local addresses in axios vulnerability discovered by ? in WordPress Npm axios versions = 0.31.0, 0.33.0...
NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype
NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype vulnerability discovered by ? in WordPress Npm protobufjs versions = 8.2.0, = 8.6.4...
NPM: protobufjs: Denial of Service via infinite loop in .proto option parsing
NPM: protobufjs: Denial of Service via infinite loop in .proto option parsing vulnerability discovered by ? in WordPress Npm protobufjs versions = 7.5.0, = 7.6.4...
NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...
NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...
NPM: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
NPM: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch vulnerability discovered by ? in WordPress Npm astro versions = 6.4.7, 6.4.8...
NPM: node-tar: Process crash via PAX numeric path type confusion
NPM: node-tar: Process crash via PAX numeric path type confusion vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...
NPM: node-tar: Decompression/parse DoS via unlimited input
NPM: node-tar: Decompression/parse DoS via unlimited input vulnerability discovered by ? in WordPress Npm tar versions = 7.5.18...
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...
NPM: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
NPM: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records vulnerability discovered by ? in WordPress Npm tar versions = 7.5.16...
NPM: Socket.IO: Engine.IO Polling Transport Connection Exhaustion
NPM: Socket.IO: Engine.IO Polling Transport Connection Exhaustion vulnerability discovered by ? in WordPress Npm engine.io versions = 4.1.0, 6.6.7...
NPM: shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
NPM: shell-quote: Quadratic-complexity Denial of Service in parse CWE-407 vulnerability discovered by ? in WordPress Npm shell-quote versions = 1.8.4...
NPM: Directus: Authorization-dependent response served from unsegmented cache key
NPM: Directus: Authorization-dependent response served from unsegmented cache key vulnerability discovered by ? in WordPress Npm directus versions 12.0.0...
NPM: Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
NPM: Directus: SSRF Protection Bypass via 0.0.0.0 in File Import vulnerability discovered by ? in WordPress Npm directus versions 12.0.0...
NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.1.0...
NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption
NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.0...
NPM: js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
NPM: js-yaml: Quadratic-complexity On^2 DoS via !!omap tag in YAML11SCHEMA vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.0...
NPM: Astro: Reflected XSS via unescaped View Transition animation properties
NPM: Astro: Reflected XSS via unescaped View Transition animation properties vulnerability discovered by ? in WordPress Npm astro versions = 2.9.0, = 7.0.9...
NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...
WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Essential Addons for Elementor versions = 6.6.11...
WordPress Tutor LMS Elementor Addons plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor plugin Activation vulnerability
Missing Authorization to Authenticated Subscriber+ Tutor LMS and Elementor plugin Activation vulnerability discovered by ? in WordPress Plugin Tutor LMS Elementor Addons versions = 4.0.0...
WordPress MapSVG – Vector maps, Image maps, Google Maps plugin <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload vulnerability
Authenticated Administrator+ Arbitrary File Upload vulnerability discovered by ? in WordPress Plugin MapSVG versions = 8.14.0...
NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service
NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...
NPM: Axios: Prototype pollution auth subfields can inject Basic auth
NPM: Axios: Prototype pollution auth subfields can inject Basic auth vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.18.0...
NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...
WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Contact Form by WPForms versions = 2.0.0.1...
WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Essential Addons for Elementor versions = 6.6.11...
WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Smart Manager versions = 8.90.0...
WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Spectra versions = 2.19.28...
WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dutafi in WordPress Plugin Sunshine Photo Cart versions = 3.6.10.1...
WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Real Estate Manager Pro versions = 12.8.5...
WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by manop55555 in WordPress Plugin Slider Pro versions = 4.8.13...
WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin Picture Gallery versions = 1.6.5...
NPM: ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
NPM: ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes vulnerability discovered by ? in WordPress Npm exifreader versions = 4.40.0...