NPM: budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

NPM: budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL vulnerability discovered by ? in WordPress Npm budibase versions 3.39.19...

WordPress Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin 1.7.1058-1.7.1059 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Jack Taylor in WordPress Plugin Royal Elementor Addons versions 1.7.1058-1.7.1059...

WordPress Creavi Appointment Booking Calendar plugin <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Creavi Appointment Booking Calendar versions = 1.4.4...

WordPress Woosa – Marktplaats for WooCommerce plugin <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read vulnerability

Authenticated Administrator+ Arbitrary File Read vulnerability discovered by Legion Hunter in WordPress Plugin Woosa – Marktplaats for WooCommerce versions = 2.0.5...

WordPress WP DSGVO Tools (GDPR) plugin <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure vulnerability discovered by kalomba - KAPENTEST in WordPress Plugin WP DSGVO Tools GDPR versions = 3.1.39...

WordPress Bogo plugin <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Andrew Lacambra in WordPress Plugin Bogo versions = 3.9.1...

WordPress Advanced Import plugin <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery vulnerability

Authenticated Author+ Server-Side Request Forgery vulnerability discovered by loris4py in WordPress Plugin Advanced Import versions = 1.4.6...

WordPress Blocksy Companion plugin <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by Pasindu Dilshan K4PXD - HACK KAP PVT LTD in WordPress Plugin Blocksy Companion versions = 2.1.45...

WordPress BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Craniums in WordPress Plugin BetterDocs versions = 4.5.3...

WordPress Classified Listing – AI-Powered Classified ads & Business Directory plugin <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Feature Modification vulnerability discovered by Ben Tamam Ben Tamam in WordPress Plugin Classified Listing versions = 5.4.2...

WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Sajjad Haqi in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Fusion Builder versions = 3.15.4...

NPM: OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

NPM: OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...

WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Koutrouss Naddara in WordPress Plugin H5P versions = 1.17.6...

WordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ParkHyunWoo in WordPress Plugin Stylish Cost Calculator versions = 8.3.9...

WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by hhhai in WordPress Plugin Premmerce Wishlist for WooCommerce versions = 1.1.11...

NPM: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

NPM: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent vulnerability discovered by ? in WordPress Npm undici versions = 7.23.0, 7.28.0...

NPM: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

NPM: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.28.0...

NPM: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

NPM: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass vulnerability discovered by ? in WordPress Npm undici versions = 8.0.0, 8.5.0...

NPM: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

NPM: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.0.0...

NPM: DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

NPM: DOMPurify: Permanent ALLOWEDATTR pollution via setConfig bypassing the hook clone-guard incomplete fix of the 3.4.7 hook-pollution patch vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.10...

NPM: npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

NPM: npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining vulnerability discovered by ? in WordPress Npm praisonai versions = 1.5.1, = 1.7.1...

NPM: npm PraisonAI AgentLoop onToolCall approval runs after tool execution

NPM: npm PraisonAI AgentLoop onToolCall approval runs after tool execution vulnerability discovered by ? in WordPress Npm praisonai versions = 1.4.0, = 1.7.1...

NPM: npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

NPM: npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call vulnerability discovered by ? in WordPress Npm praisonai versions = 1.5.0, = 1.7.1...

NPM: npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation

NPM: npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation vulnerability discovered by ? in WordPress Npm praisonai versions = 1.6.0, = 1.7.1...

NPM: PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

NPM: PraisonAI: Remote Code Execution via Sandbox Escape in codeMode Tool vulnerability discovered by ? in WordPress Npm praisonai versions = 1.7.1...

NPM: npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

NPM: npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining vulnerability discovered by ? in WordPress Npm praisonai versions = 1.2.3, = 1.7.1...

NPM: npm PraisonAI codeMode sandbox escape via Function constructor

NPM: npm PraisonAI codeMode sandbox escape via Function constructor vulnerability discovered by ? in WordPress Npm praisonai versions = 1.4.0, = 1.7.1...

NPM: npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

NPM: npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients vulnerability discovered by ? in WordPress Npm praisonai versions = 1.2.3, = 1.7.1...

NPM: npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

NPM: npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation vulnerability discovered by ? in WordPress Npm praisonai versions = 1.5.1, = 1.7.1...

WordPress APIExperts Square for WooCommerce plugin <= 4.7.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou in WordPress Plugin APIExperts Square for WooCommerce versions = 4.7.3...

WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin Syncee Premium Dropshipping & Wholesale versions = 1.0.27...

WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ossacip Thanh in WordPress Plugin MDTF versions = 1.3.8...

WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Media LIbrary Assistant versions = 3.35...

WordPress User Admin Simplifier plugin <= 3.0.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by 有馬 龍成 in WordPress Plugin User Admin Simplifier versions = 3.0.0...

WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Roll in WordPress Plugin MDTF versions = 1.3.7...

WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dhamdham in WordPress Plugin Royal MCP versions = 1.4.25...

WordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by qdtad in WordPress Plugin Vitepos versions = 3.4.2...

WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Newsletters versions = 4.13...

NPM: TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

NPM: TinaCMS rich-text slatejson rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes vulnerability discovered by ? in WordPress Npm tinacms versions 3.9.3...

NPM: Hydro: Insufficient session expiration when recreating sessions

NPM: Hydro: Insufficient session expiration when recreating sessions vulnerability discovered by ? in WordPress Npm hydrooj versions = 4.10.4, = 5.0.1...

NPM: http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

NPM: http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in fixRequestBody vulnerability discovered by ? in WordPress Npm http-proxy-middleware versions = 3.0.4, 3.0.7...

NPM: http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

NPM: http-proxy-middleware router host+path substring matching allows Host-header-driven backend routing bypass vulnerability discovered by ? in WordPress Npm http-proxy-middleware versions = 0.16.0, 2.0.10...

WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by dodoh4t in WordPress Plugin Trinity Backup Backup, Migrate, Restore, Clone & Schedule Backups versions = 2.0.9...

NPM: piscina: Prototype Pollution Gadget → RCE via inherited options.filename

NPM: piscina: Prototype Pollution Gadget → RCE via inherited options.filename vulnerability discovered by ? in WordPress Npm piscina versions = 4.9.2...

NPM: jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()

NPM: jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set vulnerability discovered by ? in WordPress Npm jodit versions 4.12.26...

NPM: OpenClaw: Tool group policy callers could accept unvalidated group IDs

NPM: OpenClaw: Tool group policy callers could accept unvalidated group IDs vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.24...

NPM: OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

NPM: OpenClaw: Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.2...

NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check

NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.10-beta.1...

WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin Intranet & Private Site All-In-One Intranet versions = 1.8.1...