52727 matches found
WordPress Envira Gallery plugin < 1.16.1 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Envira Photo Gallery versions 1.16.1...
WordPress Academy LMS plugin < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure vulnerability
Subscriber+ Arbitrary Lesson Content Disclosure vulnerability discovered by Morato Antoine in WordPress Plugin Academy LMS versions 4.0.0...
WordPress Frontend Dashboard plugin < 3.0.0 - Subscriber+ Profile and Post Field Deletion vulnerability
Subscriber+ Profile and Post Field Deletion vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Frontend Dashboard versions 3.0.0...
NPM: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
NPM: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json vulnerability discovered by ? in WordPress Npm knowns versions = 0.29.1...
WordPress Core 7.1.0-7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments (Comments administration screen) vulnerability
Unauthenticated Stored Cross-Site Scripting via Pending Comments Comments administration screen vulnerability discovered by Thomas Chauchefoin Trail of Bits in WordPress core versions 7.1-7.1.2...
WordPress Core <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Imgur oEmbed vulnerability discovered by Zhengyu Liu, Jingcheng Yang, Gavin Zhong in WordPress core versions = 7.1.2...
WordPress Core <= 7.1.2 - Author+ Broken Access Control to Sticky Posts via REST API vulnerability
Author+ Broken Access Control to Sticky Posts via REST API vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...
WordPress Core <= 7.1.2 - Contributor+ DoS via infinite loop in WP_Http::make_absolute_url() vulnerability
Contributor+ DoS via infinite loop in WPHttp::makeabsoluteurl vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability discovered by Ananda Dhakal Patchstack in WordPress core versions = 7.1.2...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Hippolyte Quéré Hippie Hippie in WordPress Plugin Kirki versions = 6.3.1...
WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Theme Traveler versions = 3.2.9...
WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability
Deserialization of untrusted data vulnerability discovered by Rafie Muhammad in WordPress Plugin MainWP Child versions = 6.2.1...
NPM: Payload didn't enforce field-level password update restrictions
NPM: Payload didn't enforce field-level password update restrictions vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...
NPM: Payload: ReDoS in Multipart Content-Type Validation
NPM: Payload: ReDoS in Multipart Content-Type Validation vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...
NPM: Payload vulnerable to API key disclosure through ordinary document reads
NPM: Payload vulnerable to API key disclosure through ordinary document reads vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...
NPM: Payload relationship-query authorization bypass
NPM: Payload relationship-query authorization bypass vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...
NPM: Payload: Token refresh and password reset responses may expose restricted user fields
NPM: Payload: Token refresh and password reset responses may expose restricted user fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...
NPM: Payload: Field access control bypass on auth collections
NPM: Payload: Field access control bypass on auth collections vulnerability discovered by ? in WordPress Npm payload versions 3.0.0, 3.90.0...
NPM: Payload: SQL Injection in SQLite and Postgres
NPM: Payload: SQL Injection in SQLite and Postgres vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.88.0...
NPM: Payload: Untrusted redirect URL parameter exploit
NPM: Payload: Untrusted redirect URL parameter exploit vulnerability discovered by ? in WordPress Npm payload versions = 3.40.0, 3.88.0...
NPM: Payload: Polymorphic join queries could disclose hidden fields
NPM: Payload: Polymorphic join queries could disclose hidden fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...
NPM: Payload: Password hashes use insufficient PBKDF2 iterations
NPM: Payload: Password hashes use insufficient PBKDF2 iterations vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...
NPM: Payload: Sort queries could expose protected field information
NPM: Payload: Sort queries could expose protected field information vulnerability discovered by ? in WordPress Npm payload versions 3.88.0...
NPM: i18next-http-backend incomplete URL validation permits SSRF
NPM: i18next-http-backend incomplete URL validation permits SSRF vulnerability discovered by ? in WordPress Npm i18next-http-backend versions 4.0.2...
NPM: sharp : Vulnerability in librsvg dependency CVE-2026-96889
NPM: sharp : Vulnerability in librsvg dependency CVE-2026-96889 discovered by ? in WordPress Npm sharp versions 0.35.5...
NPM: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
NPM: shell-quote: quote command injection via a line terminator in a token after a comment token vulnerability discovered by ? in WordPress Npm shell-quote versions = 1.8.4, 1.11.0...
NPM: pbkdf2 rehashes long passwords on every iteration, enabling denial of service
NPM: pbkdf2 rehashes long passwords on every iteration, enabling denial of service vulnerability discovered by ? in WordPress Npm pbkdf2 versions = 3.1.6...
WordPress elegro Crypto Payment plugin <= 1.0.1 - Unauthenticated Arbitrary Order Status Change vulnerability
Unauthenticated Arbitrary Order Status Change vulnerability discovered by JunHee CHO in WordPress Plugin elegro Crypto Payment versions = 1.0.1...
WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Suhayb Ahmed in WordPress Plugin WPSection versions = 1.5.1...
WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Aydan Arabadzha in WordPress Plugin ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions = 1.5.3...
WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Aydan Arabadzha in WordPress Plugin Wordable versions = 8.2.10...
WordPress Pubjet | پابجت plugin <= 5.4.8 - Settings Change vulnerability
Settings Change vulnerability discovered by Aydan Arabadzha in WordPress Plugin Pubjet | پابجت versions = 5.4.8...
WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Jotform AI Chatbot versions = 3.8.2...
WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Akbarov Rauf in WordPress Plugin aBlocks versions = 2.16.0...
WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FV Flowplayer Video Player versions = 7.5.54.7212...
WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by Yukusawa18 in WordPress Plugin PeepSo versions = 9.0.5.4...
WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteVault – Backup, Restore, Migration & Cloning versions = 1.5.19...
WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Swish Migrate and Backup versions = 1.4.0...
WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Web Plura Backup & Restore Manager versions = 0.2.25...
WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by William Honnér in WordPress Plugin Social Share Icons & Social Share Buttons versions = 3.7.5...
WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Plugin Qode Music versions = 2.1.8.2...
WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Plugin Qode Real Estate versions = 1.1.7.3...
WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability
SQL Injection vulnerability discovered by neurotx in WordPress Plugin Events Manager versions = 7.4.6...
WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FV Player 8 versions = 8.1.8...
WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Tutor LMS versions = 4.1.0...
WordPress Deema Payment Gateway plugin <= 1.1.2 - Unauthenticated Payment Confirmation Forgery vulnerability
Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Deema Payment Gateway versions = 1.1.2...
WordPress Deema Payment Gateway plugin <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation vulnerability
Unauthenticated Payment Bypass and Order Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Deema Payment Gateway versions = 1.1.2...
WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.2...
WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Gloria Admin Panel versions = 1.3...
WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP File Download versions = 6.3.6...