NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...

WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Essential Addons for Elementor versions = 6.6.11...

WordPress Tutor LMS Elementor Addons plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor plugin Activation vulnerability

Missing Authorization to Authenticated Subscriber+ Tutor LMS and Elementor plugin Activation vulnerability discovered by ? in WordPress Plugin Tutor LMS Elementor Addons versions = 4.0.0...

WordPress MapSVG – Vector maps, Image maps, Google Maps plugin <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload vulnerability

Authenticated Administrator+ Arbitrary File Upload vulnerability discovered by ? in WordPress Plugin MapSVG versions = 8.14.0...

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...

NPM: Axios: Prototype pollution auth subfields can inject Basic auth

NPM: Axios: Prototype pollution auth subfields can inject Basic auth vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.18.0...

NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Contact Form by WPForms versions = 2.0.0.1...

WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Essential Addons for Elementor versions = 6.6.11...

WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Smart Manager versions = 8.90.0...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Spectra versions = 2.19.28...

WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dutafi in WordPress Plugin Sunshine Photo Cart versions = 3.6.10.1...

WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Real Estate Manager Pro versions = 12.8.5...

WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by manop55555 in WordPress Plugin Slider Pro versions = 4.8.13...

WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin Picture Gallery versions = 1.6.5...

NPM: ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

NPM: ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes vulnerability discovered by ? in WordPress Npm exifreader versions = 4.40.0...

NPM: mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

NPM: mcp-memory-keeper: Arbitrary local file read in contextimport via unvalidated filePath vulnerability discovered by ? in WordPress Npm mcp-memory-keeper versions 0.13.0...

WordPress Core <= 7.0.1 - Unauthenticated REST API Batch Request Handler Confusion

Unauthenticated REST API Batch Request Handler Confusion vulnerability discovered by Adam Kues in WordPress core versions = 7.0.1...

WordPress Core <= 7.0.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by TF1T, dtro, and haongo in WordPress core versions = 7.0.1...

WordPress W3SC Elementor to Zoho CRM plugin <= 2.2.0 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by ? in WordPress Plugin W3SC Elementor to Zoho CRM versions = 2.2.0...

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by yangsori in WordPress Plugin TrueBooker versions = 1.2.3...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.6.18...

WordPress SureForms plugin <= 2.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by andrea bocchetti in WordPress Plugin SureForms versions = 2.2.1...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.17 - SQL Injection vulnerability

SQL Injection vulnerability discovered by shaman0x01 - Shaman Red Team in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.17...

WordPress Ultimate Member plugin <= 2.10.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Muhamad Visat in WordPress Plugin Ultimate Member versions = 2.10.1...

WordPress GEO my WP plugin <= 4.5.4 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by ? in WordPress Plugin GEO my WordPress versions = 4.5.4...

WordPress Under Construction plugin <= 5.76 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin Under Construction versions = 5.76...

WordPress miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WordPress Social Login and Register versions = 7.7.0...

WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Sprout Clients versions = 3.2.3...

WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Averon Averenkov in WordPress Plugin Autopay dla WooCommerce versions = 2.2.27...

WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

WordPress Download Monitor - WPForms Lock plugin = 1.0.4 - Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Download Monitor - WPForms Lock versions = 1.0.4...

WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HaiND in WordPress Plugin TrueBooker versions = 1.2.3...

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dodoh4t in WordPress Plugin Bookly versions = 27.7...

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HieuPenguinnn in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Form Vibes – Database Manager for Forms versions = 1.5.2...

WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Daniel Wade in WordPress Plugin Easy Appointments versions = 3.12.27...

WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Jakub Herman in WordPress Plugin WooCommerce Product Stock Alert versions = 3.0.6...

WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ickogz in WordPress Plugin Bookly versions = 27.7...

WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

WordPress Planyo online reservation system plugin <= 3.0 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by chaeyp, Ronnachai Sretawat Na Ayutaya Simonhaskelly, Ronnachai Chaipha rxnr in WordPress Plugin Planyo online reservation system versions = 3.0...

WordPress Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database plugin <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Chawabhon Netisingha JNX03 in WordPress Plugin Form Vibes – Database Manager for Forms versions = 1.5.2...

WordPress WP Hotel Booking plugin <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass vulnerability

Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass vulnerability discovered by valent1 in WordPress Plugin WP Hotel Booking versions = 2.3.1...

WordPress Code Engine – PHP Snippets, AI Functions & Automation for WordPress plugin <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution vulnerability

Authenticated Contributor+ Remote Code Execution vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Code Engine versions = 0.3.5...

WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.10 - Authenticated (Contributor+) Account Takeover vulnerability

Authenticated Contributor+ Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Essential Addons for Elementor versions = 6.6.10...

WordPress GEO Plugin by Squirrly SEO plugin <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting vulnerability

Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.0.0...

WordPress wpForo Forum plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by valent1 in WordPress Plugin wpForo Forum versions = 3.1.1...

WordPress Motors – Car Dealership & Classified Listings plugin plugin <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Motors versions = 1.4.112...

WordPress Majestic Support plugin <= 1.1.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin Majestic Support versions = 1.1.9...

WordPress Simple JWT Login – Allows you to use JWT on REST endpoints. plugin <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation vulnerability

Authenticated Subscriber+ Authentication Bypass to Privilege Escalation vulnerability discovered by Navapon Premkasem 71C4 71C4 in WordPress Plugin Simple JWT Login versions = 3.6.6...

WordPress SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover vulnerability

Unauthenticated Linked WordPress Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin SureCart versions = 4.2.3...