WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Really Simple CSV Importer versions = 1.3...

WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Zarinpal Gateway versions = 5.1.0...

WordPress Polylang plugin <= 3.8.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang versions = 3.8.5...

WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ЮKassa для WooCommerce versions = 2.16.1...

WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Securepeak Research Team in WordPress Plugin MapSVG versions = 8.14.0...

WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Slider for WooCommerce versions = 1.13.62...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Ebook Store versions = 6.19...

WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by anhcd05 in WordPress Plugin Quiz And Survey Master versions = 11.2.0...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin Ebook Store versions = 6.19...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin MapSVG versions = 8.14.0...

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, = 2.4.2...

NPM: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

NPM: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 discovered by ? in WordPress Npm sharp versions 0.35.0...

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits vulnerability discovered by ? in WordPress Npm fast-xml-parser versions = 5.9.3, 5.10.1...

NPM: TypeORM: migration:generate template-literal code injection

NPM: TypeORM: migration:generate template-literal code injection vulnerability discovered by ? in WordPress Npm typeorm versions 0.3.31...

WordPress Ultimate Addons for Elementor plugin <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 2.9.1...

NPM: SVGO removeScripts plugin leaves some executable scripts intact

NPM: SVGO removeScripts plugin leaves some executable scripts intact vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.3...

NPM: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

NPM: DOMPurify: CUSTOMELEMENTHANDLING bypasses afterSanitizeElements for allowed custom elements. vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.11...

NPM: linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

NPM: linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text vulnerability discovered by ? in WordPress Npm linkify-it versions = 5.0.1...

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.260.0...

NPM: fast-uri vulnerable to host confusion via failed IDN canonicalization

NPM: fast-uri vulnerable to host confusion via failed IDN canonicalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.2...

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set vulnerability discovered by ? in WordPress Npm immutable versions 4.3.9...

WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by WiniS in WordPress Plugin License Manager for WooCommerce versions = 3.0.17...

NPM: Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

NPM: Immutable.js List 32-bit trie overflow → unrecoverable DoS vulnerability discovered by ? in WordPress Npm immutable versions 4.3.9...

NPM: hono/jsx does not isolate context per request, leading to cross-request data disclosure

NPM: hono/jsx does not isolate context per request, leading to cross-request data disclosure vulnerability discovered by ? in WordPress Npm hono versions = 4.11.8, 4.12.27...

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx Utility vulnerability discovered by ? in WordPress Npm hono versions = 4.0.0, 4.12.27...

NPM: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

NPM: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication vulnerability discovered by ? in WordPress Npm hono versions = 4.3.3, 4.12.27...

WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin MailPoet versions 5.30.0-5.33.0...

WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin MarketKing versions = 2.1.40...

WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Easy Form Builder versions = 4.0.12...

WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

WordPress Masteriyo - LMS plugin = 2.3.0 - Cross Site Scripting XSS vulnerability discovered by K. Sorrachat in WordPress Plugin Masteriyo - LMS versions = 2.3.0...

WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by duna in WordPress Plugin Product Enquiry for WooCommerce versions = 2.2.34.43...

WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin AffiliateWP versions = 2.34.0...

WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by dodoh4t in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Photography versions = 5.7.8...

WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Riyas M S in WordPress Plugin Knit Pay versions = 9.6.0.0...

WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by dutafi in WordPress Plugin Broadcast Live Video versions = 7.2.4...

WordPress Easy Form Builder by WhiteStudio – Drag & Drop Form Builder plugin <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by ? in WordPress Plugin Easy Form Builder versions = 4.0.11...

NPM: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

NPM: Astro: composable astro/hono pipeline bypasses security.checkOrigin when middleware is absent or misordered vulnerability discovered by ? in WordPress Npm astro versions = 7.0.0, 7.0.6...

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement vulnerability discovered by ? in WordPress Npm body-parser versions 1.20.6...

NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement incomplete fix for CVE-2026-54298 vulnerability discovered by ? in WordPress Npm astro versions 7.0.6...

NPM: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

NPM: Astro: Cross-site scripting via unescaped transition: directive values on hydrated islands vulnerability discovered by ? in WordPress Npm astro versions = 3.10.0, 7.0.4...

NPM: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

NPM: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning vulnerability discovered by ? in WordPress Npm axios versions = 0.31.1, 0.33.0...

NPM: Axios form serializer maxDepth bypass via {} metatoken

NPM: Axios form serializer maxDepth bypass via metatoken vulnerability discovered by ? in WordPress Npm axios versions = 0.31.1, 0.33.0...

NPM: Axios: Nested axios option objects can consume polluted prototype values

NPM: Axios: Nested axios option objects can consume polluted prototype values vulnerability discovered by ? in WordPress Npm axios versions = 0.8.0, 0.33.0...

NPM: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

NPM: Axios: HTTP/2 streamed uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.18.0...

NPM: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

NPM: Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.18.0...

NPM: Axios: Prototype pollution gadgets can alter axios request construction

NPM: Axios: Prototype pollution gadgets can alter axios request construction vulnerability discovered by ? in WordPress Npm axios versions 0.33.0...

NPM: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

NPM: Axios: NOPROXY bypass for 0.0.0.0 local addresses in axios vulnerability discovered by ? in WordPress Npm axios versions = 0.31.0, 0.33.0...