NPM: Flowise: Missing Authorization on Execution Update Endpoint

NPM: Flowise: Missing Authorization on Execution Update Endpoint vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress WP TripAdvisor Review Slider plugin <= 14.3 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by yuyudhn in WordPress Plugin WP TripAdvisor Review Slider versions = 14.3...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution vulnerability

Authenticated Administrator+ Arbitrary Function Execution vulnerability discovered by Itthidej Aramsri Boeing777, Waris Damkham, Teerachai Somprasong in WordPress Plugin ShopLentor versions = 3.3.7...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.5.2 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Lucius-log in WordPress Plugin Groundhogg versions = 4.5.2...

WordPress Xpro Addons — 140+ Widgets for Elementor plugin <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Creation vulnerability discovered by normaandersonfrank in WordPress Plugin Xpro Elementor Addons versions = 1.5.1...

WordPress SKT Skill Bar plugin <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin SKT Skill Bar versions = 2.6...

WordPress Backup Migration plugin <= 2.1.1 - Authenticated (Administrator+) OS Command Injection vulnerability

Authenticated Administrator+ OS Command Injection vulnerability discovered by at1as in WordPress Plugin Backup Migration versions = 2.1.1...

WordPress DTX – Dynamic Text Extension for Contact Form 7 plugin <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by SATYARTH PRAKASH XoxoL33t in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.5...

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Incomplete Credential Redaction Exposes Secrets via API

NPM: Flowise: Incomplete Credential Redaction Exposes Secrets via API vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress Search Analytics for WP plugin <= 1.4.16 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by nudien udin, nudien in WordPress Plugin WP Search Analytics versions = 1.4.16...

WordPress Simple Yearly Archive plugin <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Simple Yearly Archive versions = 2.2.4...

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress Askeet — Talk to Your WooCommerce Data plugin <= 3.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Régis SENET in WordPress Plugin Askeet versions = 3.0...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

NPM: Flowise: Authenticated arbitrary file write in the S3 Directory document loader via unsanitized S3 object keys vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

NPM: Flowise: Authenticated arbitrary file write in the S3 Directory document loader via unsanitized S3 object keys vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

NPM: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress Super Progressive Web Apps plugin <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by lucsob in WordPress Plugin Super Progressive Web Apps versions = 2.2.43...

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

WordPress PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links plugin <= 3.6.20 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Michael Iden Mickhat in WordPress Plugin Shortlinks by Pretty Links versions = 3.6.20...

NPM: Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

NPM: Flowise: DELETE /api/v1/chatflows/:id does not validate resource type, allowing agentflows:delete and chatflows:delete to delete each other’s flow type vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress Relevanssi – A Better Search plugin <= 4.27.1 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi versions = 4.27.1...

WordPress Relevanssi Premium – A Better Search plugin <= 2.30.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi Premium versions = 2.30.2...

WordPress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin <= 1.17.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Hyunsoo Jeong in WordPress Plugin WP ERP versions = 1.17.4...

NPM: Flowise RCE via SQLite Record Manager Node

NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via SQLite Record Manager Node

NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

NPM: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated overrideConfig Spread in Prediction API vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

NPM: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

NPM: Flowise: Missing authorization on /api/v1/files allows low-privileged API keys to list and delete files across workspaces within the same organization vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

NPM: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

NPM: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Thrive Architect versions = 10.9.3.1...

WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced AJAX Product Filters versions = 3.2.0.3...

WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Total Upkeep versions = 1.17.2...