WordPress Hostinger Reach plugin 1.0.6-1.8.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Hostinger Reach AI-Powered Email Marketing for WordPress versions 1.0.6-1.8.2...

WordPress Connections Business Directory plugin <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure vulnerability

Unauthenticated Non-Public Directory Entry Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Connections Business Directory versions = 10.4.67...

WordPress Safe Redirect Manager plugin < 2.3.0 - Open Redirect vulnerability

Open Redirect vulnerability discovered by berke bodur in WordPress Plugin Safe Redirect Manager versions 2.3.0...

WordPress EmbedPress plugin 4.4.9-4.6.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.4.9-4.6.6...

WordPress Audio Player Block plugin 1.1.0-1.6.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Audio Player Block – audio player gutenberg block plugin versions 1.1.0-1.6.2...

WordPress New User Approve plugin 3.1.0-3.2.9 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin New User Approve versions 3.1.0-3.2.9...

WordPress Schema & Structured Data for WP & AMP plugin < 1.67 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Thomas Valadez in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.67...

WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...

NPM: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

NPM: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.7...

NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization vulnerability discovered by ? in WordPress Npm fast-uri versions = 4.1.3, 4.1.5...

NPM: @xhmikosr/decompress: Path traversal via symlink chain

NPM: @xhmikosr/decompress: Path traversal via symlink chain vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...

NPM: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

NPM: ip-address: isInSubnet and isHostInSubnet compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

NPM: moment vulnerable to Path Traversal via crafted non-string locale name

NPM: moment vulnerable to Path Traversal via crafted non-string locale name vulnerability discovered by ? in WordPress Npm moment versions = 2.29.2, 2.31.0...

NPM: brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

NPM: brace-expansion: Quadratic-time expansion of the a,b rewrite causes CPU denial of service vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.21...

NPM: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

NPM: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.20...

NPM: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

NPM: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.19...

NPM: Socket.IO: Engine.IO Protocol Revision Mismatch DoS

NPM: Socket.IO: Engine.IO Protocol Revision Mismatch DoS vulnerability discovered by ? in WordPress Npm engine.io versions = 6.6.0, 6.6.10...

NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.1.0, 10.0.9...

NPM: Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

NPM: Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service vulnerability discovered by ? in WordPress Npm nodemailer versions = 10.0.5...

NPM: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

NPM: adm-zip: Duplicate ZIP entry names: getEntry and extractAllTo resolve to different content vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

NPM: adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

NPM: adm-zip: getDataAsync bypasses the maxOutputLength size guard enforced by the synchronous getData path vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process DoS vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

WordPress Viable URL Media Uploader plugin <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Peerapat Samatathanyakorn in WordPress Plugin Viable URL Media Uploader versions = 1.0.1...

WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin WP Directory Kit versions = 1.5.4...

WordPress Smart Slider 3 plugin <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Smart Slider 3 versions = 3.5.1.38...

WordPress HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by kiemtiendinhau in WordPress Plugin HT Mega versions = 3.1.1...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

NPM: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

NPM: adm-zip: Decompression-bomb protection fix for CVE-2026-39244 can be bypassed by declaring uncompressed size as 0 vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

NPM: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

NPM: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs - local privilege escalation vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

NPM: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

NPM: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS vulnerability discovered by ? in WordPress Npm nodemailer versions 10.0.2...

NPM: undici vulnerable to Denial of Service via orphaned RetryHandler response body

NPM: undici vulnerable to Denial of Service via orphaned RetryHandler response body vulnerability discovered by ? in WordPress Npm undici versions = 7.11.0, 7.29.1...

NPM: undici vulnerable to downstream response splitting via retry interceptor

NPM: undici vulnerable to downstream response splitting via retry interceptor vulnerability discovered by ? in WordPress Npm undici versions 6.28.1...

NPM: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

NPM: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol vulnerability discovered by ? in WordPress Npm undici versions = 6.7.0, 6.28.1...

NPM: undici vulnerable to Denial of Service via unbounded decompression of compressed responses

NPM: undici vulnerable to Denial of Service via unbounded decompression of compressed responses vulnerability discovered by ? in WordPress Npm undici versions = 7.15.0, 7.29.1...

NPM: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

NPM: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor vulnerability discovered by ? in WordPress Npm undici versions = 7.1.0, 7.29.1...

NPM: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

NPM: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool vulnerability discovered by ? in WordPress Npm undici versions = 7.24.1, 7.29.1...

NPM: undici vulnerable to caching and replay of unsafe HTTP method responses

NPM: undici vulnerable to caching and replay of unsafe HTTP method responses vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...

NPM: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

NPM: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors vulnerability discovered by ? in WordPress Npm undici versions = 8.10.0, 8.10.2...

NPM: undici vulnerable to Denial of Service via WebSocketStream unclean close

NPM: undici vulnerable to Denial of Service via WebSocketStream unclean close vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...

NPM: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

NPM: joi: Quadratic regular-expression backtracking in Joi.string.isoDate vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.7...

NPM: Electron: Local race condition in Squirrel.Mac update installation on macOS

NPM: Electron: Local race condition in Squirrel.Mac update installation on macOS vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab vulnerability discovered by ? in WordPress Npm electron versions 41.10.4...

NPM: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

NPM: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions vulnerability discovered by ? in WordPress Npm electron versions 41.10.6...

NPM: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

NPM: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled vulnerability discovered by ? in WordPress Npm electron versions 41.10.6...

NPM: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

NPM: Electron: can enable Node.js integration in Web Workers despite embedder restrictions vulnerability discovered by ? in WordPress Npm electron versions 41.10.6...