NPM: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

NPM: DOMPurify: INPLACE hook removal leaves a detached subtree executable, causing XSS vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.12...

WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Alfath Marchdika Cahyatullah in WordPress Plugin AfterShip Tracking versions = 1.18.1...

WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Payment Bypass vulnerability discovered by Alexis Lafontaine in WordPress Plugin SMEPay: UPI Gateway for WooCommerce versions = 1.0.5...

WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin AI for SEO versions = 2.4.2...

WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Mukhlis Amien in WordPress Plugin RealPress versions = 1.1.2...

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xManticore in WordPress Plugin Profile Extra Fields by BestWebSoft versions = 1.3.5...

WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Duc Canh canhnguyen26 in WordPress Plugin ReactPress versions = 3.4.0...

WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by muqsithbarru in WordPress Plugin WP Social Avatar versions = 1.5...

WordPress Blogfolio theme <=3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Blogfolio versions =3.0.5...

WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Evan NR in WordPress Plugin Salon booking system versions = 10.30.26...

WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin If-So Dynamic Content Personalization versions = 1.10...

WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Aydan Arabadzha in WordPress Plugin REST API Log versions = 1.7.1...

WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Uma Mo in WordPress Plugin MultiVendorX versions = 5.0.10...

WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Active Products Tables for WooCommerce versions = 1.1.1...

WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by winky in WordPress Plugin WPJAM Basic versions = 7.0.2.1...

WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Bitcoin Lightning Payment Gateway for WooCommerce via CLINK versions = 1.0.7...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.10...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.10...

WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by testoun in WordPress Plugin WP-Stats versions = 2.56...

WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by V1t in WordPress Plugin Car Rental Manager versions = 1.3.7...

WordPress < 7.0.3 - SSRF vulnerability

SSRF vulnerability discovered by Andrew Mohawk in WordPress core versions 7.0.3...

WordPress < 7.0.3 - CSS Injection vulnerability

CSS Injection vulnerability discovered by Anthropic in WordPress core versions 7.0.3...

WordPress < 7.0.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Elio Gubser in WordPress core versions 7.0.3...

WordPress < 7.0.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by HDWSec in WordPress core versions 7.0.3...

WordPress < 7.0.3 - Stored XSS vulnerabiliity

Stored XSS vulnerabiliity discovered by Naveen S and Ajmal Moochingal in WordPress core versions 7.0.3...

WordPress Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin Easy Accordion versions = 3.1.8...

Wordpress < 7.0.3 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by Ehtisham Siddiqui in WordPress core versions 7.0-7.0.2...

WordPress < 7.0.3 - Multiple Contributor+ Stored XSS vulnerabilities

Multiple Contributor+ Stored XSS vulnerabilities discovered by Asaf Mozes, n05ec, Alex Concha in WordPress core versions 7.0.3...

NPM: node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

NPM: node-re2: Out-of-bounds heap read in replace/split via a Buffer ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript vulnerability discovered by ? in WordPress Npm re2 versions = 1.26.0...

NPM: node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

NPM: node-re2: String.prototype.replacere2, template aborts the Node process uncatchable ToLocalChecked on empty MaybeLocal when the result exceeds V8's max string length vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.0...

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 vulnerability discovered by ? in WordPress Npm ngx-extended-pdf-viewer versions = 27.0.0-rc.0, 29.0.0-rc.3...

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF vulnerability discovered by ? in WordPress Npm pdfjs-dist versions = 5.6.83, 6.2.108...

WordPress < 7.0.3 - Subscriber+ Site Creation vulnerability

Subscriber+ Site Creation vulnerability discovered by Aikido Security in WordPress core versions 7.0.3...

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution 3.x and 4.x — CVE-2026-59870 fix not backported vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.1...

NPM: Nx: Zip-Slip in the self-hosted remote cache

NPM: Nx: Zip-Slip in the self-hosted remote cache vulnerability discovered by ? in WordPress Npm nx versions = 20.8.0, 22.7.7...

NPM: Mermaid radar diagrams are vulnerable to DoS

NPM: Mermaid radar diagrams are vulnerable to DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 11.6.0, 11.16.1...

NPM: Mermaid configuration APIs allow prototype pollution

NPM: Mermaid configuration APIs allow prototype pollution vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

NPM: Mermaid Architecture diagrams are vulnerable to prototype pollution

NPM: Mermaid Architecture diagrams are vulnerable to prototype pollution vulnerability discovered by ? in WordPress Npm mermaid versions = 11.5.0, 11.16.1...

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 10.6.0, 10.9.8...

WordPress Core < 7.0.3 - Reflected XSS to RCE vulnerability

Reflected XSS to RCE vulnerability discovered by pwn.ai in WordPress core versions 7.0.3...

WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by luc in WordPress Plugin Simple Link Directory Pro versions = 15.0.8...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.43...

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP Full Stripe Free versions = 8.5.0...

WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Jamaal ahmed in WordPress Theme AI Hub versions = 1.3.10...

WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Agrion versions = 1.0.0...