52857 matches found
NPM: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
NPM: Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
NPM: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
NPM: Hono: Unbounded dot-notation nesting in parseBody can cause memory exhaustion vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used vulnerability discovered by ? in WordPress Npm next versions = 10.0.0, 15.5.24...
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...
NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...
NPM: Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
NPM: Nodemailer: resolveContent on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.1.0...
NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: xmldom: DocType `name` Injection Bypasses requireWellFormed
NPM: xmldom: DocType name Injection Bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: xmldom: Quadratic-time attribute deduplication
NPM: xmldom: Quadratic-time attribute deduplication vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: xmldom: Quadratic-memory consumption
NPM: xmldom: Quadratic-memory consumption vulnerability discovered by ? in WordPress Npm xmldom versions = 0.1.5, = 0.6.0...
NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge vulnerability discovered by ? in WordPress Npm xmldom versions = 0.3.0, = 0.6.0...
NPM: joi: Prototype pollution via a `__proto__` language key in custom messages
NPM: joi: Prototype pollution via a proto language key in custom messages vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.6...
NPM: Colord: Slow rejection of oversized malformed color strings
NPM: Colord: Slow rejection of oversized malformed color strings vulnerability discovered by ? in WordPress Npm colord versions 2.9.4...
NPM: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
NPM: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers vulnerability discovered by ? in WordPress Npm next versions = 13.4.0, 15.5.24...
NPM: joi: object().rename() with a template target can set the validated object's prototype
NPM: joi: object.rename with a template target can set the validated object's prototype vulnerability discovered by ? in WordPress Npm joi versions = 16.0.0, 17.13.5...
NPM: MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
NPM: MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize via Live NamedNodeMap Removal Skip vulnerability discovered by ? in WordPress Npm maplibre-gl versions = 6.4.0...
NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock vulnerability discovered by ? in WordPress Npm vitest versions = 2.1.0, 4.1.11...
NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed
NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
NPM: xmldom: Attribute name injection via setAttribute bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
WordPress Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin myCred versions = 3.2.4...
WordPress WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin <= 2.23.7 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WooCommerce Google Feed Manager versions = 2.23.7...
WordPress Checkout Custom Fields Builder for WooCommerce plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by Nabil Irawan in WordPress Plugin Checkout Custom Fields Builder for WooCommerce versions = 1.1.5...
NPM: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
NPM: LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimit and crash the process vulnerability discovered by ? in WordPress Npm liquidjs versions = 10.27.1...
NPM: node-csv: Prototype replacement still reachable via columns path
NPM: node-csv: Prototype replacement still reachable via columns path vulnerability discovered by ? in WordPress Npm csv-parse versions 7.0.2...
WordPress ilGhera Reviso Exporter for WooCommerce plugin <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function vulnerability
Missing Authorization to Authenticated Subscriber+ Agreement Grant Token Deletion via disconnectcallback Function vulnerability discovered by Legion Hunter in WordPress Plugin ilGhera Reviso Exporter for WooCommerce versions = 1.2.3...
WordPress WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability
Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPFunnels versions = 3.12.13...
WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary User Denial vulnerability discovered by Wordfence PRISM in WordPress Plugin Awesome Support versions = 6.3.9...
WordPress WP Recipe Maker plugin <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Recipe Maker versions = 10.8.0...
WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management vulnerability
Missing Authorization to Authenticated Subscriber+ Notification Flow Management vulnerability discovered by Sushi Com Abacate in WordPress Plugin WP Event Solution versions = 4.1.17...
WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability
Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...
WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...
WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability
Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability
Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...
WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...
WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...
WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability
Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event Solution versions = 4.1.22...
WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
Content Injection vulnerability discovered by kta1kri in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability
Captcha Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...
WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability
Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...
WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin WPAdverts versions = 2.3.3...
WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Tony Harris in WordPress Plugin Thank You Page Customizer for WooCommerce versions = 1.2.2...
WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by CidKagenouSama in WordPress Plugin WP Travel versions = 12.0.3...
WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Page Visits Counter Lite versions = 1.2.3...
WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin Return Refund and Exchange For WooCommerce versions = 4.6.4...
WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by dodoh4t in WordPress Plugin Youzify versions = 1.3.7...
WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin MailMunch – Grow your Email List versions = 3.2.5...