WordPress Aurora Heatmap plugin <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Aurora Heatmap versions = 1.7.2...

WordPress Nexi XPay Build plugin <= 7.6.2 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin Nexi XPay Build versions = 7.6.2...

WordPress Nexi XPay Build plugin <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure vulnerability

Unauthenticated Payment Completion and Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Nexi XPay Build versions = 7.6.2...

NPM: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

NPM: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, .first/.last, negative index, and for-loop iteration vulnerability discovered by ? in WordPress Npm liquidjs versions = 10.27.1...

NPM: Ghost: Authorization Bypass in Comments Feature

NPM: Ghost: Authorization Bypass in Comments Feature vulnerability discovered by ? in WordPress Npm ghost versions = 5.9.0, 6.44.1...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

NPM: Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

NPM: Ghost: Path Traversal Vulnerability in Ghost ImageSize Service discovered by ? in WordPress Npm ghost versions = 6.14.0, 6.27.0...

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server vulnerability discovered by ? in WordPress Npm quasar versions = 2.23.2...

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead vulnerability discovered by ? in WordPress Npm quasar versions 2.22.0...

WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme DukaMarket versions = 1.3.0...

WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Uminex versions = 1.0.9...

WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme DK versions = 3.2.1...

WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand News versions = 3.4...

WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Kids Care versions = 3.2.4...

WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme The Voux versions = 6.9.5...

WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Pond versions = 2.6.1...

WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Education Center versions = 3.6.12...

WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme ColorFolio versions = 1.3...

WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Neo | Barber Shop WordPress Theme versions = 3.5...

WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Werkstatt versions = 4.8.3...

WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress Whistle - Sports Club theme = 4.2 - Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Whistle - Sports Club versions = 4.2...

WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Kids Planet versions = 2.2.14.2...

WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Voldor versions = 1.0.0...

WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Ogency versions = 1.0.0...

WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Treck versions = 1.0.0...

WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Slider by 10Web versions = 1.2.63...

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions = 6.0.5...

WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Qode Tours versions = 3.1.3.2...

WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability

Arbitrary Shortcode Execution vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Boutique versions = 2.3.3...

WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme KuteShop versions = 4.2.9...

WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme KuteShop versions = 4.2.9...

WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Boutique versions = 2.3.3...

WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Biolife versions = 3.2.3...

WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Biolife versions = 3.2.3...

WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme TechOne versions = 3.0.3...

WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme TechOne versions = 3.0.3...

WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Armania versions = 1.4.8...

WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Armania versions = 1.4.8...

WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Aalto versions = 1.8...

WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme CleanSkin versions = 1.5.0...

WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate CSV Importer versions = 9.2...

WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme CleanSkin versions = 1.5.0...

WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Post Author versions = 4.0.0...

WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slider by 10Web versions = 1.2.63...

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by she11f in WordPress Plugin Barcode Scanner with Inventory & Order Manager versions = 1.13.1...

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by she11f in WordPress Plugin Barcode Scanner with Inventory & Order Manager versions = 1.13.1...