WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Khoa Dang in WordPress Plugin LearnPress versions = 4.4.8...

NPM: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

NPM: Serialize JavaScript: Cross-site scripting XSS via unescaped in serialized function bodies vulnerability discovered by ? in WordPress Npm serialize-javascript versions = 7.1.1, 7.1.2...

WordPress WP Popular Posts plugin <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters vulnerability

Unauthenticated Information Disclosure in 'posttype' and 'context' Parameters vulnerability discovered by mad4cyber in WordPress Plugin Popular Posts versions = 7.4.2...

NPM: DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

NPM: DOMPurify: INPLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.13, = 3.4.15...

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor vulnerability discovered by ? in WordPress Npm axios versions = 1.0.0, 1.20.0...

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.20.0...

NPM: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

NPM: Axios: CIDR-form NOPROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF vulnerability discovered by ? in WordPress Npm axios versions = 1.17.0, 1.20.0...

NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.20.0...

NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method vulnerability discovered by ? in WordPress Npm axios versions = 0.27.2, 0.34.0...

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS vulnerability discovered by ? in WordPress Npm axios versions = 1.16.1, 1.20.0...

NPM: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

NPM: Axios: ReDoS ON² in shouldBypassProxy host normalization, reachable via untrusted redirect Location vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.34.0...

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.20.0...

NPM: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

NPM: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.20.0...

NPM: Next.js: Remote Code Execution in next/og ImageResponse

NPM: Next.js: Remote Code Execution in next/og ImageResponse vulnerability discovered by ? in WordPress Npm next versions = 16.2.0, 16.3.6...

WordPress EWWW Image Optimizer plugin 8.6.0 - 8.7.7 - Author+ PHP Object Injection vulnerability

WordPress EWWW Image Optimizer plugin 8.6.0 - 8.7.7 - Author+ PHP Object Injection vulnerability discovered by Karthik in WordPress Plugin EWWW Image Optimizer versions 8.6.0-8.7.7...

WordPress User Frontend plugin 2.5.8-4.3.11 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 2.5.8-4.3.11...

WordPress FluentCart A New Era of eCommerce plugin < 1.6.5 - Unauthenticated Guest Customer Account Takeover vulnerability

Unauthenticated Guest Customer Account Takeover vulnerability discovered by Mutantgun in WordPress Plugin FluentCart versions 1.6.5...

WordPress Solace Extra plugin < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure vulnerability

Unauthenticated Non-Published Post Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Solace Extra versions 1.7.2...

NPM: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

NPM: Nodemailer addressparser: On^2 on comment-joined addresses enables a remote DoS reachable via mailparser vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.1.0, = 10.0.4...

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.5...

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions = 3.36...

WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Luke Eldridge in WordPress Plugin CURCY versions 2.2.18...

WordPress Newsletter – Send awesome emails from WordPress plugin <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials vulnerability

Unauthenticated Insufficiently Protected Credentials vulnerability discovered by Swayam in WordPress Plugin Newsletter versions = 9.3.9...

WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Branda versions = 3.4.32...

WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Extra Product Options For WooCommerce | Custom Product Addons and Fields versions = 3.3.8...

WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Post and Page Builder by BoldGrid versions = 1.27.14...

WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Nested Pages versions = 3.3.2...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.66...

WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Photo Gallery by 10Web versions = 1.8.46...

WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin Optimole versions = 4.2.14...

WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetEngine versions = 3.8.15.3...

WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Page Builder by SiteOrigin versions = 2.36.0...

WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Ninja Forms versions = 3.15.3...

WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Premium Addons for Elementor versions = 4.11.105...

WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Qi Addons For Elementor versions = 1.11...

WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Happy Addons for Elementor versions = 3.23.1...

WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin Flexible PDF Coupons versions = 1.14.11...

WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WPFunnels versions = 3.13.1...

WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability

Other vulnerability Type vulnerability discovered by khado in WordPress Plugin Creator LMS versions = 1.2.19...

WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Business Directory versions = 6.4.27...

WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin User Submitted Posts versions = 20260810...

WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Activity Log versions = 5.6.6...

WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Intrudify in WordPress Plugin Photo Gallery by Supsystic versions = 1.21.0...

WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin King Addons for Elementor versions = 51.1.86...

WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Supreme Modules Lite versions = 2.5.63...

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.4...