WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tawatchai Pinsuwan in WordPress Plugin Additional Order Filters for WooCommerce versions = 1.24...

WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by hackthesoul in WordPress Plugin AIWU versions = 1.5.9...

WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Muhammad Sobirov in WordPress Plugin Everest Backup versions = 2.3.13...

WordPress Slider Pro plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Seongwon Lee in WordPress Plugin Slider Pro versions = 1.0.0...

WordPress Fast Courier plugin <= 5.2.3 - Unauthenticated Order Fulfillment Update vulnerability

Unauthenticated Order Fulfillment Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Fast Courier versions = 5.2.3...

WordPress File Media Renamer plugin <= 1.3 - Author+ Arbitrary File Rename vulnerability

Author+ Arbitrary File Rename vulnerability discovered by Sebastian Riveros in WordPress Plugin File Media Renamer versions = 1.3...

NPM: simple-git unsafe-operation guard does not block trailer command configuration

NPM: simple-git unsafe-operation guard does not block trailer command configuration vulnerability discovered by ? in WordPress Npm simple-git versions = 3.15.0, 4.0.1...

NPM: simple-git allows command execution through unblocked Git configuration includes

NPM: simple-git allows command execution through unblocked Git configuration includes vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291 vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...

NPM: DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

NPM: DOMPurify: INPLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.15...

NPM: smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

NPM: smol-toml: Quadratic-time parse from parseKey rescanning to end of document on each key line vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.8.0...

NPM: KaTeX: Existing prototype pollution can bypass trust restrictions

NPM: KaTeX: Existing prototype pollution can bypass trust restrictions vulnerability discovered by ? in WordPress Npm katex versions = 0.11.0, 0.18.2...

NPM: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

NPM: Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw vulnerability discovered by ? in WordPress Npm seroval versions = 0.12.0, = 1.6.0...

NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization vulnerability discovered by ? in WordPress Npm seroval versions = 1.6.2...

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet vulnerability discovered by ? in WordPress Npm proxy-addr versions = 1.1.0, 2.0.8...

NPM: Nx: OS command injection via git revisions and remote refs

NPM: Nx: OS command injection via git revisions and remote refs vulnerability discovered by ? in WordPress Npm nx versions = 14.0.0, 22.7.8...

NPM: Nx daemon and plugin worker sockets are accessible to other local users

NPM: Nx daemon and plugin worker sockets are accessible to other local users vulnerability discovered by ? in WordPress Npm nx versions = 14.6.0, 22.7.9...

NPM: Nx: Path traversal in nx migrate package-migrations extraction

NPM: Nx: Path traversal in nx migrate package-migrations extraction vulnerability discovered by ? in WordPress Npm nx versions = 13.10.0, 22.7.10...

NPM: compression vulnerable to Denial of Service via memory leak on premature response close

NPM: compression vulnerable to Denial of Service via memory leak on premature response close vulnerability discovered by ? in WordPress Npm compression versions 1.8.2...

NPM: vm2: NodeVM custom resolution bypasses external path boundaries

NPM: vm2: NodeVM custom resolution bypasses external path boundaries vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

NPM: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

NPM: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

NPM: Snowflake drivers writes sensitive information to logs

NPM: Snowflake drivers writes sensitive information to logs vulnerability discovered by ? in WordPress Npm snowflake-sdk versions 3.3.0...

NPM: PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

NPM: PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion vulnerability discovered by ? in WordPress Npm postcss-selector-parser versions 7.1.6...

NPM: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values

NPM: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values vulnerability discovered by ? in WordPress Npm fast-copy versions 2.2.0...

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution vulnerability discovered by ? in WordPress Npm tinypool versions = 2.1.0...

NPM: Tinypool: Prototype Pollution Gadget to RCE in run() options

NPM: Tinypool: Prototype Pollution Gadget to RCE in run options vulnerability discovered by ? in WordPress Npm tinypool versions 2.1.2...

NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk vulnerability discovered by ? in WordPress Npm stream-json versions = 3.5.0...

NPM: stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

NPM: stream-json has a prototype pollution issue: Assembler writes this.currentthis.key on plain objects vulnerability discovered by ? in WordPress Npm stream-json versions 3.6.0...

NPM: vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

NPM: vm2: allowAsync: false can be bypassed through Promise thenable assimilation in VM and NodeVM vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

NPM: vm2: Sandbox Escape (NodeVM)

NPM: vm2: Sandbox Escape NodeVM vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

NPM: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

NPM: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.0, = 3.11.7...

NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.0, = 3.11.7...

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

NPM: vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack

NPM: vm2: util.getCallSites bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

NPM: ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

NPM: ProseMirror has a XSS vulnerability in prosemirror-view's paste handling discovered by ? in WordPress Npm prosemirror-view versions 1.42.3...

NPM: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

NPM: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.0, = 3.11.6...

NPM: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

NPM: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback Unbounded Host Event-Loop Block vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

NPM: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

NPM: vm2: NodeVM require.external without an explicit require.root grants unrestricted host filesystem access and full RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

NPM: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

NPM: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

NPM: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

NPM: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.1, = 3.11.6...

WordPress ACPT (Premium) plugin <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.66...

WordPress Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Post SMTP versions = 4.0.1...

WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Image Slider Widget versions = 1.1.130...

WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LevinityCyber in WordPress Plugin GDPR Framework By Data443 versions = 2.5.0...

WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin WooCommerce Multivendor Marketplace – REST API versions = 1.6.3...

WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aydan Arabadzha in WordPress Plugin SendPress Newsletters versions = 1.26.1.20...

WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mohamed Bassia in WordPress Plugin Advanced Posts Listing – Show Post List Easily versions = 1.0.8...

WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Settings Change vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin TrueBooker versions = 1.2.9...

WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 10Web Social Photo Feed versions = 1.4.35...