47810 matches found
WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin WP Booking System versions 5.12.8.1...
WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by HieuPenguinnn in WordPress Plugin reCAPTCHA v2 & v3 for Asgaros Forum versions = 1.1.0...
WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability
Other Vulnerability Type vulnerability discovered by dodoh4t in WordPress Plugin Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More versions = 2.2.0...
WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin ChatBot versions = 8.3.7...
WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by TristanInSec in WordPress Plugin Tutor LMS versions = 3.9.13...
WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Plugin RT-Theme 18 | Extensions versions = 2.5...
WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Plugin RT-Theme 18 | Extensions versions = 2.5...
WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin RT-Theme 18 | Extensions versions = 2.5...
WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by kai63001 in WordPress Plugin AcyMailing SMTP Newsletter versions = 10.11.0...
WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by anhcd05 in WordPress Plugin AcyMailing SMTP Newsletter versions = 10.11.1...
WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin AcyMailing SMTP Newsletter versions = 10.11.0...
WordPress tagDiv Composer plugin <= 5.4.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin tagDiv Composer versions = 5.4.5...
WordPress tagDiv Cloud Library plugin <= 3.9.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin tagDiv Cloud Library versions = 3.9.5...
WordPress tagDiv Opt-In Builder plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin tagDiv Opt-In Builder versions = 1.7.5...
WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bonds in WordPress Theme Flatsome versions = 3.20.5...
WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Theme Flatsome versions = 3.20.5...
WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin Kirki versions = 6.0.12...
WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by VanTastic in WordPress Plugin Kirki versions = 6.0.11...
WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin Kirki versions = 6.0.12...
WordPress Kirki plugin <= 6.1.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Psalms Christopher Matovu ByteOverride in WordPress Plugin Kirki versions = 6.1.1...
WordPress Exclusive Addons for Elementor plugin <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Exclusive Addons Elementor versions = 2.7.9.8...
WordPress Comments – wpDiscuz plugin <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by mickeyjoe in WordPress Plugin wpDiscuz versions = 7.6.56...
WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Ultimate Member versions = 2.11.4...
WordPress JSON API User plugin <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Yat in WordPress Plugin JSON API User versions = 4.1.0...
WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Taichi Kashimura in WordPress Plugin NEX-Forms versions = 9.2.2...
WordPress CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by sterva - Teletronics in WordPress Plugin CURCY versions = 2.2.14...
WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.5.2 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by tjoffe in WordPress Plugin Printcart Web to Print Product Designer for WooCommerce versions = 2.5.2...
WordPress AR for WooCommerce plugin <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read vulnerability
Unauthenticated Path Traversal to Arbitrary File Read vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin AR For Woocommerce versions = 8.40...
WordPress AR for WordPress plugin <= 8.40 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin AR For WordPress versions = 8.40...
WordPress Index Now plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Index Now versions = 3.0.16...
WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FormLayer versions = 1.0.6...
WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Exclusive Addons Elementor versions = 2.7.9.9...
NPM: 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
NPM: 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING vulnerability discovered by ? in WordPress Npm 9router versions = 0.4.55...
NPM: 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
NPM: 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass vulnerability discovered by ? in WordPress Npm 9router versions = 0.2.21, = 0.4.41...
NPM: 9router: Missing Authorization and OS Command Injection
NPM: 9router: Missing Authorization and OS Command Injection vulnerability discovered by ? in WordPress Npm 9router versions 0.4.44...
NPM: jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
NPM: jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion vulnerability discovered by ? in WordPress Npm jsonata versions 2.2.0...
WordPress LatePoint – Calendar Booking Plugin for Appointments and Events plugin <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification vulnerability
Missing Authorization to Unauthenticated Arbitrary Customer Data Modification vulnerability discovered by hhhai in WordPress Plugin LatePoint versions = 5.6.1...
NPM: electerm has Command Injection in File System Operations (rmrf, mv, cp)
NPM: electerm has Command Injection in File System Operations rmrf, mv, cp vulnerability discovered by ? in WordPress Npm electerm versions = 3.11.0...
NPM: electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling
NPM: electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling vulnerability discovered by ? in WordPress Npm electerm versions = 3.11.0...
WordPress Zakra theme <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Zakra versions = 4.2.0...
WordPress Ad Inserter – Ad Manager & AdSense Ads plugin <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Arbitrary Post Content Disclosure vulnerability discovered by nightward in WordPress Plugin Ad Inserter versions = 2.8.16...
WordPress Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Quiz Modification and Email Reroute vulnerability discovered by Kirasec in WordPress Plugin Quiz And Survey Master versions = 11.1.4...
WordPress RTMKit plugin <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin RTMKit versions = 2.0.7...
NPM: OpenClaw: Native command authorization could skip owner-command enforcement
NPM: OpenClaw: Native command authorization could skip owner-command enforcement vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...
NPM: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
NPM: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.7...
NPM: OpenClaw: Trusted retry endpoint checks could match hostname prefixes
NPM: OpenClaw: Trusted retry endpoint checks could match hostname prefixes vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.7...
NPM: OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
NPM: OpenClaw: Telegram interactive callbacks could skip commands.allowFrom vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...
NPM: OpenClaw: Matrix allowFrom could bind to mutable display names
NPM: OpenClaw: Matrix allowFrom could bind to mutable display names vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.6...
NPM: OpenClaw: Mattermost slash token revocation could lag until monitor refresh
NPM: OpenClaw: Mattermost slash token revocation could lag until monitor refresh vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.23...
NPM: OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
NPM: OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...