52842 matches found
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteSkite versions = 2.1.8...
WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability
Path Traversal vulnerability discovered by JunHee CHO in WordPress Plugin Creator LMS versions = 1.2.19...
WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MCP Content Manager Lite versions = 1.1.0...
WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Music Player for WooCommerce versions = 1.9.1...
WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Conversational Forms for ChatBot versions = 1.5.0...
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Zahid Abbasi in WordPress Plugin FormGent versions = 1.12.2...
WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin JW Player for WordPress versions = 2.3.11...
WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Geo Mashup versions = 1.13.21...
WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Morato Antoine in WordPress Plugin WP Express Checkout Accept PayPal Payments versions = 2.4.9...
WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Responsive Slider Gallery versions = 1.5.5...
WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability
SQL Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Books Gallery versions = 4.8.3...
WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin oik versions = 4.15.4...
WordPress HT Contact Form – Drag & Drop Form Builder for WordPress plugin <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin HT Contact Form 7 versions = 2.10.2...
WordPress ConvertPlus plugin <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection vulnerability
Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ConvertPlus versions = 3.6.3...
NPM: Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
NPM: Nodemailer: Process-global DNS cache reuses TLS servername across transports, enabling cross-tenant SMTP credential disclosure vulnerability discovered by ? in WordPress Npm nodemailer versions = 5.0.0, 10.0.2...
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression vulnerability discovered by ? in WordPress Npm undici versions = 6.25.0, 6.28.1...
NPM: multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
NPM: multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads vulnerability discovered by ? in WordPress Npm multer versions = 2.2.0, 2.4.0...
NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields vulnerability discovered by ? in WordPress Npm morgan versions 1.12.1...
NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize
NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.6...
NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.5...
NPM: ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
NPM: ip-address: Address6.isLinkLocal recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts vulnerability discovered by ? in WordPress Npm ip-address versions = 10.5.0...
NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.2.0, = 10.5.0...
NPM: scim-patch: Mutation of Inherited Built-in Method Objects
NPM: scim-patch: Mutation of Inherited Built-in Method Objects vulnerability discovered by ? in WordPress Npm scim-patch versions 0.9.2...
NPM: code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
NPM: code-ollama: grepsearch Command Injection via Unescaped $ Shell Substitution CWE-78 vulnerability discovered by ? in WordPress Npm code-ollama versions = 0.36.0...
WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...
WordPress File Manager plugin 7.2.2-8.0.4 - Unauthenticated Database Backup Disclosure vulnerability
Unauthenticated Database Backup Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin File Manager versions 7.2.2-8.0.4...
WordPress Verge3D Publishing and E-Commerce plugin 4.1.0-4.13.0 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin Verge3D versions 4.1.0-4.13.0...
WordPress Paymattic plugin 4.6.20-4.6.25 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Artus KG in WordPress Plugin Best Payments Plugin for WP versions 4.6.20-4.6.25...
WordPress Blacklist Manager plugin 1.3.0-2.3.1 - Blocked User Restriction Bypass vulnerability
Blocked User Restriction Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Blacklist Manager WooCommerce Anti-Fraud, Blacklist & Checkout Verification versions 1.3.0-2.3.1...
WordPress Bookly plugin < 28.3 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by vuxvinh in WordPress Plugin Bookly versions 28.3...
WordPress WPForms plugin 1.5.0.1-2.0.2.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Contact Form by WPForms versions 1.5.0.1-2.0.2.0...
WordPress Malcure Malware Shield — Removal, Repair, Monitor plugin < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability
Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability discovered by Charles Vosburgh in WordPress Plugin Malcure Malware Scanner versions 19.9.7...
WordPress Verge3D Publishing and E-Commerce plugin <= 4.13.0 - Unauthenticated Product Download Disclosure vulnerability
Unauthenticated Product Download Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin Verge3D versions = 4.13.0...
WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ Post Publication and Author Spoofing vulnerability
Contributor+ Post Publication and Author Spoofing vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...
WordPress Download Manager plugin 4.0.0-7.5.5 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Andy in WordPress Plugin Download Manager versions 4.0.0-7.5.5...
WordPress Testimonials Widget plugin <= 4.0.4 - Unauthenticated SSRF vulnerability
Unauthenticated SSRF vulnerability discovered by Naiches in WordPress Plugin Testimonials Widget versions = 4.0.4...
WordPress File Manager Pro plugin < 2.1.3 - DOM-based XSS vulnerability
DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin File Manager Pro versions 2.1.3...
WordPress FileOrganizer plugin < 1.2.1 - DOM-based XSS vulnerability
DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin FileOrganizer versions 1.2.1...
WordPress File Manager plugin < 8.0.5 - DOM-based XSS vulnerability
DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin Bit File Manager versions 8.0.5...
WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...
WordPress Bluff Post plugin <= 1.1.1 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Bluff Post versions = 1.1.1...
WordPress SPS-Suite plugin <= 1.4.0 - Unauthenticated Time-Based SQLi vulnerability
Unauthenticated Time-Based SQLi vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin SPS-Suite versions = 1.4.0...
WordPress Post Voting System plugin <= 1.0 - Subscriber+ SQLi vulnerability
Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Post Voting System versions = 1.0...
WordPress Testimonials Widget plugin <= 4.0.4 - Unauthenticated Arbitrary Post Update vulnerability
Unauthenticated Arbitrary Post Update vulnerability discovered by Naiches in WordPress Plugin Testimonials Widget versions = 4.0.4...
WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ SQLi vulnerability
Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...
WordPress Groups – Memberships and Access Control plugin <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability
Authenticated Subscriber+ Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Groups versions = 4.6.0...
WordPress Request a Quote for WooCommerce plugin <= 2.9.2 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by t4g0 in WordPress Plugin Request a Quote for WooCommerce versions = 2.9.2...
WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.5 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin miniorange otp verification versions = 5.5.5...
WordPress Ad Inserter plugin 2.8.12-2.8.18 - Subscriber+ RCE / Stored XSS vulnerability
Subscriber+ RCE / Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Ad Inserter versions 2.8.12-2.8.18...