WordPress Instant Appointment plugin <= 1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Random Robbie in WordPress Plugin Instant Appointment versions = 1.2...

WordPress WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Remote Code Execution vulnerability discovered by daroo in WordPress Plugin WP Ultimate CSV Importer versions = 8.0.1...

NPM: systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

NPM: systeminformation: OS command injection in networkInterfaces via interfaces5 source-directive path on Linux vulnerability discovered by ? in WordPress Npm systeminformation versions = 5.31.6...

NPM: dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

NPM: dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS vulnerability discovered by ? in WordPress Npm dd-trace versions 5.100.0...

NPM: websocket-driver: Resource limit bypass via message compression

NPM: websocket-driver: Resource limit bypass via message compression vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

NPM: websocket-driver: Message corruption via abuse of protocol length headers

NPM: websocket-driver: Message corruption via abuse of protocol length headers vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/path — arbitrary host file read/write/delete vulnerability discovered by ? in WordPress Npm obsidian-local-rest-api versions 4.1.3...

WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by K. Sorrachat in WordPress Plugin WP ERP versions = 1.17.5...

NPM: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

NPM: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode vulnerability discovered by ? in WordPress Npm n8n-mcp versions = 2.57.3...

NPM: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

NPM: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution vulnerability discovered by ? in WordPress Npm tidgi versions = 0.13.0...

NPM: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

NPM: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments vulnerability discovered by ? in WordPress Npm n8n-mcp versions = 2.56.0...

WordPress Genolve – Genolve AI Business Graphics, AI Images plugin <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation vulnerability

Authenticated Contributor+ Incorrect Authorization to Privilege Escalation vulnerability discovered by Kazuma Matsumoto in WordPress Plugin Genolve versions = 5.0.5...

WordPress bbp style pack plugin <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin bbp style pack versions = 6.4.5...

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Valatty in WordPress Plugin CorvusPay WooCommerce Payment Gateway versions = 2.7.4...

WordPress W3 Total Cache plugin <= 2.9.4 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by snr in WordPress Plugin W3 Total Cache versions = 2.9.4...

WordPress WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection vulnerability

Unauthenticated Time-Based Blind SQL Injection vulnerability discovered by daroo in WordPress Plugin WordPress CTA versions = 2.2.2...

WordPress Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin <= 2.8.4 - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation vulnerability

WordPress Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin = 2.8.4 - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit = 2.8.4 - Unauthenticated Privilege Escalation vulnerability discovered by lb in WordPress Plugin Aimogen Pro versions =...

WordPress Ultimate WooCommerce Auction Pro plugin <= 2.4.5 - Reflected XSS via uwa_manage_auctions vulnerability

Reflected XSS via uwamanageauctions vulnerability discovered by Kacper Rybczyński in WordPress Plugin Ultimate Auction Pro versions = 2.4.5...

WordPress Ultimate WooCommerce Auction Pro plugin <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list vulnerability

Reflected XSS via uwaauctionsbidslist vulnerability discovered by Kacper Rybczyński in WordPress Plugin Ultimate Auction Pro versions = 2.4.5...

WordPress ICS Calendar plugin <= 12.0.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Khanh Nguyen - BlueRock in WordPress Plugin ICS Calendar versions = 12.0.9...

WordPress Booking Package plugin <= 1.7.20 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by PRISM in WordPress Plugin Booking Package versions = 1.7.20...

WordPress WP Customer Area plugin <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WP Customer Area versions = 8.3.5...

WordPress FoodBook Lite – Online Food Ordering System plugin <= 1.5.6 - Missing Authorization to Unauthenticated User Registration vulnerability

Missing Authorization to Unauthenticated User Registration vulnerability discovered by Eason in WordPress Plugin FoodBook Lite – Online Food Ordering System versions = 1.5.6...

WordPress News Kit Addons For Elementor plugin <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin News Kit Elementor Addons versions = 1.4.6...

WordPress Avada (Fusion) Builder plugin <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Zbigniew Piotrak in WordPress Plugin Fusion Builder versions = 3.15.5...

WordPress Smart Slider 3 plugin <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Yuvraj Tomar in WordPress Plugin Smart Slider 3 versions = 3.5.1.37...

WordPress Academy LMS plugin <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by sorawautsukushiii in WordPress Plugin Academy LMS versions = 3.8.0...

WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ووسلام همگام سازی ووکامرس و باسلام versions = 1.9.1...

WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin گرویتی فرم فارسی versions = 3.0.2...

WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce Bulk Edit Products – WP Sheet Editor versions = 1.8.21...

NPM: SafeInstall agent guard shell parsing can miss raw package execution

NPM: SafeInstall agent guard shell parsing can miss raw package execution vulnerability discovered by ? in WordPress Npm safeinstall-cli versions 0.10.2...

NPM: adm-zip: Crafted ZIP file triggers 4GB memory allocation

NPM: adm-zip: Crafted ZIP file triggers 4GB memory allocation vulnerability discovered by ? in WordPress Npm adm-zip versions 0.6.0...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Form Entry Modification vulnerability discovered by Michael Iden Mickhat in WordPress Plugin NEX-Forms versions = 9.2.2...

WordPress Cost Calculator Builder plugin <= 4.0.11 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by oper999 in WordPress Plugin Cost Calculator Builder versions = 4.0.11...

WordPress Wallet for WooCommerce plugin <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration vulnerability

Missing Authorization to Authenticated Subscriber+ User/Email Enumeration vulnerability discovered by Mitchell in WordPress Plugin TeraWallet – For WooCommerce versions = 1.6.4...

WordPress fresh Podcaster plugin <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin fresh Podcaster versions = 1.0.7...

WordPress Catalyst Connect Zoho CRM Client Portal plugin <= 2.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by siyuan shao in WordPress Plugin Catalyst Connect Zoho CRM Client Portal versions = 2.2.0...

WordPress Context Blog theme <= 1.3.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ryoma Nishioka in WordPress Theme Context Blog versions = 1.3.5...

WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection vulnerability discovered by Niv Kochan in WordPress Plugin WCFM – Frontend Manager for WooCommerce versions = 6.7.27...

WordPress WP Easy Pay – Payment and Donation form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Status Modification vulnerability discovered by PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress Widgets for Google Reviews plugin <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by coih in WordPress Plugin Widgets for Google Reviews versions = 13.3...

WordPress White Label CMS plugin <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Tal Kantor in WordPress Plugin White Label CMS versions = 2.7.12...

WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability discovered by mrholmes, papadope in WordPress Plugin WCFM – Frontend Manager for WooCommerce versions = 6.7.27...

WordPress WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting vulnerability

Authenticated Vendor+ Stored Cross-Site Scripting vulnerability discovered by Nadir Şensoy in WordPress Plugin WCFM Marketplace versions = 3.7.3...

NPM: tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

NPM: tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies vulnerability discovered by ? in WordPress Npm tarteaucitronjs versions 1.33.0...

WordPress Agentic Help Desk plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk plugin <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Cache Deletion vulnerability discovered by Legion Hunter in WordPress Plugin ThriveDesk versions = 2.1.7...

WordPress Themify Builder plugin <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by PRISM in WordPress Plugin Themify Builder versions = 7.7.6...

WordPress Themify Builder plugin <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by PRISM in WordPress Plugin Themify Builder versions = 7.7.6...

WordPress Starboard Suite Reservation Calendars plugin <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Starboard Suite Reservation Calendars versions = 3.1.4...

WordPress AI Copilot – Content Generator plugin <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Modification vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.12...