NPM: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

NPM: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise vulnerability discovered by ? in WordPress Npm devalue versions = 5.8.0, = 5.9.2...

NPM: devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

NPM: devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...

NPM: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

NPM: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env vulnerability discovered by ? in WordPress Npm piscina versions 4.9.4...

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking vulnerability discovered by ? in WordPress Npm basic-ftp versions = 6.2.0...

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Intrudify in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Dthangws in WordPress Plugin Kirki versions = 6.3.1...

WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by bamper1 in WordPress Plugin hCaptcha for WP versions = 5.3.0...

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ByteCoreStack MCP Connector for AI Tools versions = 1.2.2...

WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Raphael P. Cigana in WordPress Plugin Authorizer versions = 3.15.3...

WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin WP Project Manager versions = 4.0.7...

WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by SecondGateWP in WordPress Plugin Social Boost versions = 3.6.2...

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Bus Ticket Booking with Seat Reservation versions = 5.9.3...

WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Aruba Migration Tool versions = 1.0.4...

WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Seongwon LEE in WordPress Plugin Premmerce Wishlist for WooCommerce versions = 1.1.13...

WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Romain Deperne in WordPress Plugin CF7 Apps versions = 3.7.2...

WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Captivate Sync versions = 3.3.2...

WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Zenith in WordPress Plugin ProfileGrid versions = 6.0.0.2...

WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ori Ashkenazi tarzeh in WordPress Plugin WpTravelly versions = 2.3.1...

WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Essential Addons for Elementor versions = 6.8.4...

WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Metform versions = 4.3.0...

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register versions = 3.8.4.13...

WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability

SQL Injection vulnerability discovered by cazy in WordPress Plugin BuildKit – Product Builder for WooCommerce – Custom PC Builder versions = 1.0.28...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.6...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.6...

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin AFFI – Affiliate Marketing for WooCommerce versions = 1.0.9...

WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Peter Tang in WordPress Plugin Majestic Support versions = 1.2.0...

WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Majestic Support versions = 1.2.0...

WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin FluentForm versions = 6.2.14...

WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by SecondGateWP in WordPress Plugin Gratisfaction versions = 4.6.3...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by whp-wessel in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

WordPress Five Star Restaurant Reviews plugin < 2.3.14 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by V1T in WordPress Plugin Five Star Restaurant Reviews versions 2.3.14...

WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Thaer Assfour in WordPress Plugin Site Reviews versions = 8.3.2...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ayukiab in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Oly Hossen in WordPress Plugin AcyMailing SMTP Newsletter versions = 11.0.5...

WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability

WordPress Memberful - Membership Plugin plugin = 1.81.0 - Cross Site Request Forgery CSRF vulnerability discovered by henise in WordPress Plugin Memberful - Membership Plugin versions = 1.81.0...

WordPress Paytm Payment Gateway plugin < 2.8.9 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Paytm Payment Gateway versions 2.8.9...

WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MaxGalleria versions = 6.5.3...

WordPress Business Essentials for Contact Form 7 plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Contact Form 7 Redirect & Thank You Page versions = 1.2.1...

WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin REST API Log versions = 1.7.2...

WordPress Duplicate Post plugin <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Duplicate Post versions = 1.5.6...

WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Supakiad S. m3ez in WordPress Plugin WPFunnels versions = 3.13.1...

WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Parallax Section block versions = 2.0.4...

WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Premmerce Wishlist for WooCommerce versions = 1.1.13...

WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Full Stripe Free versions = 8.5.6...

WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Brobicho in WordPress Plugin Review Schema versions 3.1.0...

WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Form Maker by 10Web versions = 1.15.47...

WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide Shipping Method For WooCommerce versions = 1.5.4...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Nhien Pham nhienit nhienit in WordPress Plugin Awesome Support versions = 6.4.0...