52842 matches found
NPM: Orval: Import-time RCE via enum-typed default -> zod module-level template literal
NPM: Orval: Import-time RCE via enum-typed default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
NPM: Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
NPM: Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
NPM: Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
NPM: Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
NPM: LiquidJS has an infinite loop vulnerability in its `strip_html` filter
NPM: LiquidJS has an infinite loop vulnerability in its striphtml filter discovered by ? in WordPress Npm liquidjs versions = 10.26.0, 10.27.1...
WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.3...
WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by ChinhNguyen in WordPress Plugin SureForms versions = 2.12.5...
WordPress KP Agent Ready plugin <= 1.1.99 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin KP Agent Ready versions = 1.1.99...
WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.5...
WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin SEOPress versions = 10.1...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Johan Buenavida in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.17...
WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Booking and Rental Manager versions = 2.7.7...
WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin WPKoi Templates for Elementor versions = 3.7.2...
WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Agentimus – AI SEO, llms.txt & MCP for AI Agents versions = 1.51.0...
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.20...
WordPress Quick Event Manager plugin <= 9.18 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Quick Event Manager versions = 9.18...
WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by sungbyeongchan in WordPress Plugin BookIt versions = 2.6.0.3...
WordPress Quick Event Manager plugin <= 9.18 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by she11f in WordPress Plugin Quick Event Manager versions = 9.18...
WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by NamDang in WordPress Plugin Timetics versions = 1.0.61...
WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin JobSearch versions = 3.2.0...
WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by WiniS in WordPress Plugin Mail Mint versions = 1.31.0...
WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by endy in WordPress Plugin Mail Mint versions = 1.31.0...
WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin WPFunnels versions = 3.12.13...
WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by nh4tvd in WordPress Plugin Business Directory versions = 6.4.26...
WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentBooking Pro versions = 2.2.1...
WordPress Pre-Orders for WooCommerce plugin <= 2.3.1 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by MoonFuji in WordPress Plugin Pre-Orders for WooCommerce versions = 2.3.1...
WordPress WC Ukraine Shipping plugin <= 1.22.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WC Ukraine Shipping versions = 1.22.5...
WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by sungbyeongchan in WordPress Plugin Business Directory versions = 6.4.26...
WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Shared Files Pro versions 1.7.70...
WordPress Simple Ajax Chat plugin < 20260827 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Simple Ajax Chat versions 20260827...
WordPress FAQ Builder AYS plugin 1.6.3-1.8.4 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin FAQ Builder AYS versions 1.6.3-1.8.4...
WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability
Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...
WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...
WordPress Rank Math SEO plugin < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability
Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...
WordPress GamiPress plugin < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award vulnerability
Subscriber+ Arbitrary User Points and Achievement Award vulnerability discovered by Shivamani Vastrala in WordPress Plugin GamiPress versions 7.9.9.6...
WordPress Social Media Share Buttons & Social Sharing Icons plugin < 3.0.1 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Social Media & Share Icons versions 3.0.1...
WordPress Photo Gallery by 10Web plugin < 1.8.44 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Photo Gallery by 10Web versions 1.8.44...
WordPress JetBackup plugin 3.1.7.9-3.1.23.3 - Subscriber+ Privilege Escalation vulnerability
Subscriber+ Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Backup Guard versions 3.1.7.9-3.1.23.3...
WordPress Advanced Custom Fields: Extended plugin < 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability
Unauthenticated Administrator Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ACF Extended versions 0.9.2.7...
WordPress Advanced Custom Fields: Extended plugin 0.9.2.2-0.9.2.6 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.2-0.9.2.6...
WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Theme Enfold versions = 8.0...
WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification vulnerability
Missing Authorization to Unauthenticated JetEngine Options Page Modification vulnerability discovered by andrea bocchetti in WordPress Plugin JetFormBuilder versions = 3.6.2...
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 vulnerability discovered by ? in WordPress Npm link-preview-js versions = 4.0.3...
WordPress Divi theme <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions = 4.27.6...
WordPress GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin GutenKit versions = 2.4.4...
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.2, 2.4.5...
NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...
NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
NPM: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.1, 2.4.5...
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...
NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
NPM: fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count vulnerability discovered by ? in WordPress Npm fastify versions = 5.8.3, 5.12.1...