49938 matches found
WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter vulnerability
WordPress Online Scheduling and Appointment Booking System - Bookly plugin = 27.7 - Authenticated Staff+ Insecure Direct Object Reference to Sensitive Information Exposure via 'paramsid' Parameter vulnerability discovered by Raihan Adi Arba in WordPress Plugin Bookly versions = 27.7...
WordPress NEX-Forms plugin <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter vulnerability
Authenticated Admin+ SQL Injection via 'additionalparams' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin NEX-Forms versions = 9.2.4...
WordPress Kubio AI Page Builder plugin <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action vulnerability
Missing Authorization to Authenticated Contributor+ Front-Page/Menu/Template Configuration Reversion via kubiorestorefrontpage AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Kubio AI Page Builder versions = 2.8.5...
WordPress Loco Translate plugin <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments vulnerability
Authenticated Translator+ Stored Cross-Site Scripting via PO File Extracted Comments vulnerability discovered by MatilJ in WordPress Plugin Loco Translate versions = 2.8.7...
WordPress Gravity Booster plugin <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter vulnerability
Authenticated Editor+ Stored Cross-Site Scripting via 'stylerSettings' Parameter vulnerability discovered by wandoo in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 5.26...
WordPress Fullscreen Galleria plugin <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content vulnerability
Authenticated Contributor+ SQL Injection via 'href' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Fullscreen Galleria versions = 1.6.12...
WordPress Frontend Admin by DynamiApps plugin <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter vulnerability
Unauthenticated Privilege Escalation via 'itemid' Parameter vulnerability discovered by 밥김국 - DDADDA in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.9...
WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability
WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin = 3.5.2 - Missing Authorization to Authenticated Delegated+ Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability discovered by skyv3il in WordPress Plugin Everest Forms...
WordPress Autopay plugin <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'bmwoocommercecsseditorcontent' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Autopay versions = 5.0.0...
WordPress Advanced File Manager plugin <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability
Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability discovered by skyv3il in WordPress Plugin Advanced File Manager versions = 5.4.12...
WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability
WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin = 1.6.12.10 - Authenticated Contributor+ Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by Michael Iden Mickhat - Hack The Box in WordPress Plugin Simply Schedu...
WordPress Admin Custom Login plugin <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability discovered by Ryoma Nishioka in WordPress Plugin Admin Custom Login versions = 3.6.4...
WordPress ECS plugin < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability
Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability discovered by Seongwon LEE in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...
WordPress Backup Migration plugin < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login vulnerability
Admin+ Privilege Escalation via Post-Restore Auto-Login vulnerability discovered by Thanh Lam Tang in WordPress Plugin Backup Migration versions 2.1.7...
WordPress Product Feed PRO for WooCommerce plugin < 13.5.7 - Unauthenticated Feed Configuration Disclosure vulnerability
Unauthenticated Feed Configuration Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Product Feed PRO for WooCommerce versions 13.5.7...
WordPress Simply Schedule Appointments plugin < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability
Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simply Schedule Appointments versions 1.6.12.17...
WordPress ECS plugin < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability
Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability discovered by Shivamani Vastrala in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...
WordPress ECS plugin < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload vulnerability
Unauthenticated Private Content Disclosure via ecsload vulnerability discovered by Jashid Sany in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...
WordPress Link Library plugin <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter vulnerability
Unauthenticated Arbitrary File Deletion via linkurl Parameter vulnerability discovered by nudien in WordPress Plugin Link Library versions = 7.9.4...
WordPress WPML Multilingual CMS plugin <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter vulnerability
Authenticated Translator+ SQL Injection via 'sorting' Parameter vulnerability discovered by momopon1415 in WordPress Plugin Multilingual CMS versions = 4.9.5...
WordPress Templately plugin <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch vulnerability
Authenticated Contributor+ Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Templately versions = 3.7.1...
WordPress Real Estate Manager Pro plugin <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision vulnerability
Authenticated Subscriber+ Privilege Escalation via 'userhascap' Filter ID Collision vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Real Estate Manager Pro versions = 12.8.6...
NPM: MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
NPM: MLflow: CreateModelVersion source validation does not check READ permission on referenced runid vulnerability discovered by ? in WordPress Npm mlflow versions 3.15.0...
NPM: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
NPM: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth vulnerability discovered by ? in WordPress Npm mlflow versions 3.15.0...
NPM: 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
NPM: 9Router: Authenticated Server-Side Request Forgery SSRF via OIDC Provider Test Endpoint vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...
NPM: chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
NPM: chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots vulnerability discovered by ? in WordPress Npm chrome-devtools-mcp versions = 0.24.0, = 1.0.1...
WordPress Forminator Forms plugin <= 1.56.1 - Unauth. Arbitrary File Upload
Unauth. Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...
NPM: Etherpad has stored XSS in HTML export via unescaped attribute-pool values
NPM: Etherpad has stored XSS in HTML export via unescaped attribute-pool values vulnerability discovered by ? in WordPress Npm epetherpad-lite versions = 1.8.14...
NPM: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
NPM: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling vulnerability discovered by ? in WordPress Npm epetherpad-lite versions = 1.8.14...
NPM: vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
NPM: vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...
NPM: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
NPM: vm2: NodeVM builtin: '' exposes os and dns — process-wide observability reads AND writes that hijack the host sibling class of GHSA-9g8x-92q2-p28f vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...
NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...
NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...
NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...
WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 6.1...
WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin RomethemeForm For Elementor versions = 1.2.6...
WordPress WP Table Builder plugin <= 2.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Table Builder versions = 2.2.1...
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.16.20...
WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.22...
WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...
NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs
NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs vulnerability discovered by ? in WordPress Npm deepmerge-ts versions 8.0.0...
WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
Remote File Inclusion vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions 1.14.2...
WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions = 1.13.0...
WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Chaty Pro versions = 3.5.8...
WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Subscribe2 versions = 10.46...
WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by 20kilograma in WordPress Plugin ThumbPress versions 6.5...
WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by VanTastic in WordPress Plugin Modern Events Calendar versions 7.35.0...
WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Aotuman Grab WeChat Articles versions = 2.0.1...
WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by 0xVenus in WordPress Plugin Gravity Forms Bookings premium versions = 2.1...
WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Nabil Irawan in WordPress Plugin Sync Post With Other Site versions = 1.9.3...