NPM: OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions

NPM: OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.12...

NPM: OpenClaw: memory-wiki ingest could read local files with operator.write scope

NPM: OpenClaw: memory-wiki ingest could read local files with operator.write scope vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.12...

WordPress CM Business Directory – Optimise and showcase local business plugin <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin CM Business Directory versions = 1.5.7...

WordPress WP Import Export Lite plugin <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability

Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by 밥김국 - DDADDA in WordPress Plugin WP Import Export Lite versions = 3.9.30...

NPM: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

NPM: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

NPM: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: OpenClaw: QQBot native approval buttons did not enforce configured approver identity

NPM: OpenClaw: QQBot native approval buttons did not enforce configured approver identity vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

NPM: OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.20...

NPM: OpenClaw: Control UI locality spoofing could mint a durable admin device token

NPM: OpenClaw: Control UI locality spoofing could mint a durable admin device token vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.22...

WordPress Ninja Forms - File Uploads plugin <= 3.3.29 - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion vulnerability

WordPress Ninja Forms - File Uploads plugin = 3.3.29 - File Uploads = 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion vulnerability discovered by Ad4m5 in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.29...

NPM: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

NPM: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

NPM: OpenClaw's marketplace runtime extension metadata could point at unscanned payloads vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: OpenClaw's browser act interactions could bypass private-network navigation checks

NPM: OpenClaw's browser act interactions could bypass private-network navigation checks vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: OpenClaw: Shell wrapper argv could change between approval and execution

NPM: OpenClaw: Shell wrapper argv could change between approval and execution vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.16...

NPM: OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

NPM: OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.12...

NPM: OpenClaw: Exec approval display truncation could hide the command being approved

NPM: OpenClaw: Exec approval display truncation could hide the command being approved vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

NPM: OpenClaw: Message read actions could skip channel allowlist checks

NPM: OpenClaw: Message read actions could skip channel allowlist checks vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.19-beta.2...

WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Tonda versions = 2.5...

WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin TheGem Theme Elements for Elementor versions = 5.11.1...

WordPress Struktur Core plugin <= 2.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Struktur Core versions = 2.5.1...

WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Struktur versions = 2.5.1...

WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme SetSail versions = 2.1...

WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Nuss versions = 1.3.6...

WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Overworld versions = 1.5...

WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin NewsPlus Shortcodes versions = 4.2.0...

WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh in WordPress Theme EduMall versions = 4.5.1...

WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Kitchor versions = 1.4.3...

WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Leedo versions = 3.0.0...

WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Golo Framework versions = 1.7.3...

WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Dør versions = 2.4.1...

WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flow versions = 1.8...

WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Brook versions = 2.9.0...

WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Aqua versions = 5.1.2...

WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Billey versions = 2.1.8...

WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Aalto versions = 1.8...

WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Phat RiO in WordPress Plugin CWS SVGicons versions = 1.5.5...

WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability

Cross Site Request Forgery CSRF to Broken Authentication vulnerability discovered by Phat RiO in WordPress Plugin WorkScout-Core versions = 1.7.08...

WordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by w41bu1 in WordPress Plugin Speaker versions = 4.1.13...

WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Advanced Shipment Tracking for WooCommerce versions = 4.0...

WordPress Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin <= 4.3.5 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by PRISM in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Universal Clocks versions = 1.2.0...

WordPress MeetingHub plugin <= 1.26.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin MeetingHub versions = 1.26.1...

WordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jitlada in WordPress Plugin Envision Page Builder versions = 0.22...

WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Theme VW Wedding versions = 1.3.7...

WordPress Fascinate theme <= 1.1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Theme Fascinate versions = 1.1.6...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Theme VW Food Corner versions = 1.1.0...

WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dodoh4t in WordPress Plugin WP Inventory Manager versions = 2.4.0...

WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by VanTastic in WordPress Plugin GD Rating System versions = 3.7...

WordPress Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations plugin <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ilkeggs in WordPress Plugin Trust.Reviews versions = 2.7.3...