WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Jakub Herman in WordPress Plugin uListing versions = 2.2.0...

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Before After Image Comparison – Image comparison for WP versions = 1.1.21...

WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by luffy in WordPress Plugin Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway versions = 1.7.2...

WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dahmani Toumi pegaSUS in WordPress Plugin AWS S3 for WordPress Plugin – Upcasted versions = 3.1.0...

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Before After Image Comparison – Image comparison for WP versions = 1.1.21...

WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin All Bootstrap Blocks versions = 1.3.31...

WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by buitu in WordPress Plugin Asgaros Forum versions = 3.4.0...

WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Html5 Audio Player versions = 2.8.8...

WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by superx in WordPress Plugin WP Event Manager versions = 3.4.1...

WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Salúa Es-sair in WordPress Plugin Restrict User Access – Membership Plugin with Force versions = 2.8.1...

WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin Scripts n Styles versions = 3.5.8...

WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin AI Translation for Polylang versions = 1.6.2...

WordPress Super Payments plugin < 1.43.1 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Super Payments versions 1.43.1...

WordPress GDPR Data Request Form plugin 1.5-1.7.1 - DPO Email Update vulnerability

DPO Email Update vulnerability discovered by Shikhali Jamalzade in WordPress Plugin GDPR Data Request Form versions 1.5-1.7.1...

WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetBlocks For Elementor versions = 1.5.2.1...

WordPress Kirki plugin < 6.3.2 - Editor+ Blind SSRF vulnerability

Editor+ Blind SSRF vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.3.2...

WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Splendour versions = 1.23...

WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Stargaze versions = 1.10...

WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Tipsy versions = 1.6...

WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Wine House versions = 3.20...

WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Yacht Rental versions = 2.6...

WordPress Ocean Pro Demos plugin <= 1.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Alex Thomas, Wordfence Argus in WordPress Plugin Ocean Pro Demos versions = 1.5.4...

WordPress Ocean eComm Treasure Box plugin <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Alex Thomas, Wordfence Argus in WordPress Plugin Ocean eComm Treasure Box versions = 1.8.0...

WordPress Redux Framework plugin <= 4.5.11 - Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation vulnerability

Redux Framework = 4.5.11 – Authenticated Subscriber+ Privilege Escalation vulnerability discovered by shark3y in WordPress Plugin Redux Framework versions = 4.5.11...

WordPress Code Snippets plugin < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite) vulnerability

Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure Multisite vulnerability discovered by Sarthak Saxena in WordPress Plugin Code Snippets versions 3.10.0...

WordPress AWP Classifieds plugin < 4.4.9 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin AWP Classifieds versions 4.4.9...

WordPress Code Snippets plugin < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability

Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Code Snippets versions 3.10.0...

WordPress SendPress Newsletters plugin <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing vulnerability

Subscriber+ Mailing List Sync and Newsletter Queueing vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin SendPress Newsletters versions = 1.26.1.20...

WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability

Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...

WordPress SendPress Newsletters plugin <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure vulnerability

Unauthenticated Newsletter Sending Log Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin SendPress Newsletters versions = 1.26.1.20...

WordPress Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More plugin <= 1.16.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Paul Serban in WordPress Plugin Envira Photo Gallery versions = 1.16.1...

WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin < 4.1.0 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by Joshua Martinelle in WordPress Plugin WP Post Author versions 4.1.0...

WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin < 4.1.0 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Joshua Martinelle in WordPress Plugin WP Post Author versions 4.1.0...

NPM: fast-jwt: Verifier cache accepts expired JWTs without iat.

NPM: fast-jwt: Verifier cache accepts expired JWTs without iat. vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.3...

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.0...

NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.0, = 6.2.4...

NPM: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

NPM: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation and persists in the verifier cache vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery vulnerability discovered by ? in WordPress Npm fast-jwt versions 6.2.4...

NPM: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

NPM: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure vulnerability discovered by ? in WordPress Npm praisonai versions 1.7.3...

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop DoS — unreleased regression on master vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...

NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser

NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...

NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...

NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...

NPM: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

NPM: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NOBACKSLASHESCAPES vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.5...

NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion permitSetMultiParamEntries vulnerability discovered by ? in WordPress Npm mariadb versions = 3.2.0, 3.2.5...

NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.5...

NPM: MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

NPM: MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS vulnerability discovered by ? in WordPress Npm mariadb versions = 3.3.0, 3.5.4...

NPM: music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

NPM: music-metadata: uncatchable process crash parsing a crafted .dsf residual of GHSA-v6c2-xwv6-8xf7 vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.14.0...