NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch

NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch vulnerability discovered by ? in WordPress Npm fastify versions 5.12.1...

NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.32.0...

NPM: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

NPM: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref vulnerability discovered by ? in WordPress Npm orval versions 8.22.0...

NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: qs array-limit bypass via bracket-key comma parsing

NPM: qs array-limit bypass via bracket-key comma parsing vulnerability discovered by ? in WordPress Npm qs versions = 6.14.2, = 6.15.3...

NPM: qs: Denial of Service via Attacker Controlled isBuffer

NPM: qs: Denial of Service via Attacker Controlled isBuffer vulnerability discovered by ? in WordPress Npm qs versions = 2.2.5, 6.16.0...

NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...

NPM: pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

NPM: pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...

WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Aydan Arabadzha in WordPress Plugin Calculation For Contact Form 7 versions = 1.0...

WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Simple Payment versions = 2.5.1...

WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Under Construction versions = 5.82...

WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Asim Alshaya in WordPress Plugin WP EasyPay versions = 4.5.3...

WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin WP QuickLaTeX versions = 3.8.8...

WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by dutafi in WordPress Plugin Bricksforge versions = 3.1.8.8...

WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tawatchai Pinsuwan in WordPress Plugin GeoDirectory versions = 2.8.174...

WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.26...

WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin BP Better Messages versions = 2.15.27...

WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jorgson in WordPress Plugin YITH Request a Quote for WooCommerce Premium versions 4.46.0...

WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability

Settings Change vulnerability discovered by Thaer.Assfour in WordPress Plugin WP Compress versions = 7.21.28...

WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by yagamimoon in WordPress Plugin WCFM Membership versions = 2.11.11...

WordPress Classified Listing plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muhammad Bilal bilalmajid1 in WordPress Plugin Classified Listing versions = 6.1.2...

WordPress Rentsyst plugin <= 2.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin Rentsyst versions = 2.1.3...

WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Tour versions = 5.5.1...

WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Roll in WordPress Plugin Product Variations Swatches for WooCommerce versions = 1.1.18...

WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HieuPenguinnn in WordPress Theme Graphene versions = 2.9.4...

WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by momopon1415 in WordPress Plugin RTMKit versions = 2.1.5...

WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin RTMKit versions = 2.1.5...

WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Migrate Guru – Site Migration & Cloning versions = 6.65...

WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MalCare Security versions = 6.69...

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by TwinSecKR in WordPress Plugin WP Statistics versions = 14.16.11...

WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Breadcrumb NavXT versions = 7.5.1...

WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by bekitousei in WordPress Plugin EWWW Image Optimizer versions = 8.7.6...

WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Really Simple SSL versions = 9.8.0...

WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by sicksec in WordPress Plugin LiteSpeed Cache versions = 7.9...

WordPress Estatik plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Neelakandan A in WordPress Plugin Estatik versions = 4.3.5...

WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Gallery PhotoBlocks versions = 1.3.4...

WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin WP Go Maps versions = 10.1.08...

WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Really Simple SSL versions = 9.8.0...

WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Broken Link Checker versions = 2.4.14...

WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin PublishPress Permissions versions = 4.8.3...

WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by John Ryan Albon in WordPress Plugin Mang Board WP versions = 2.3.8...

WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Anthony Green of Greenhat Security in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.23...

WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Uma Mo in WordPress Plugin Ultimate Gift Cards For WooCommerce versions = 3.2.9...

WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Activity Log versions = 2.13.1...

WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin TrustedSite versions = 1.2.5...

WordPress Broken Link Checker plugin <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Broken Link Checker versions = 2.4.13...

WordPress FluentCart plugin <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion vulnerability

Authenticated Custom+ Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin FluentCart versions = 1.6.2...

WordPress WP Project Manager Pro plugin <= 4.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by dutafi in WordPress Plugin WP Project Manager Pro versions = 4.0.1...

WordPress Mane theme <= 1.7 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh in WordPress Theme Måne versions = 1.7...