WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

NPM: Quasar: Prototype pollution in the extend() utility

NPM: Quasar: Prototype pollution in the extend utility vulnerability discovered by ? in WordPress Npm quasar versions = 2.21.4...

NPM: Shescape: Quadratic-time denial of service in the flag-protection

NPM: Shescape: Quadratic-time denial of service in the flag-protection vulnerability discovered by ? in WordPress Npm shescape versions = 2.1.11, 2.1.14...

NPM: Shescape: Home-directory disclosure in assignment context on Unix with Dash

NPM: Shescape: Home-directory disclosure in assignment context on Unix with Dash vulnerability discovered by ? in WordPress Npm shescape versions 2.1.14...

NPM: Shescape: Shell injection via unescaped parentheses on Windows with CMD

NPM: Shescape: Shell injection via unescaped parentheses on Windows with CMD vulnerability discovered by ? in WordPress Npm shescape versions 2.1.14...

NPM: Shescape: Path disclosure on Unix with Zsh

NPM: Shescape: Path disclosure on Unix with Zsh vulnerability discovered by ? in WordPress Npm shescape versions 2.1.14...

NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.17...

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock vulnerability discovered by ? in WordPress Npm sm-crypto versions 0.5.0...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-turbopack versions = 19.0.0, 19.0.8...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-webpack versions = 19.0.0, 19.0.8...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-parcel versions = 19.1.0, 19.1.9...

WordPress Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Yoast SEO versions = 28.0...

NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service

NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.1...

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 8.3.0...

NPM: AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

NPM: AWS CDK CodeBuild S3 Log Encryption Boolean Inversion vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.253.0...

NPM: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

NPM: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection vulnerability discovered by ? in WordPress Npm tar versions = 7.5.20...

NPM: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

NPM: PostCSS: Path Traversal in Previous Source Map Auto-Loading sourceMappingURL leads to Arbitrary .map File Disclosure vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.17...

NPM: Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

NPM: Mongoose: Prototype pollution in mongoose update casting via proto-prefixed dotted path Schema.getSchema/path getter vulnerability discovered by ? in WordPress Npm mongoose versions 6.13.10...

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor bypass of GHSA-j658-c2gf-x6pq fix vulnerability discovered by ? in WordPress Npm velocityjs versions = 2.1.6...

NPM: Trix: Stored XSS via HTMLParser attribute injection on paste

NPM: Trix: Stored XSS via HTMLParser attribute injection on paste vulnerability discovered by ? in WordPress Npm trix versions 2.1.18...

NPM: Valibot: record() issue paths can make flatten() throw for inherited Object property names

NPM: Valibot: record issue paths can make flatten throw for inherited Object property names vulnerability discovered by ? in WordPress Npm valibot versions = 1.4.1...

NPM: seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

NPM: seroval: seroval.fromJSON Promise resolver type confusion invokes attacker-controlled methods during deserialization vulnerability discovered by ? in WordPress Npm seroval versions = 1.5.2...

NPM: Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

NPM: Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in vulnerability discovered by ? in WordPress Npm better-auth versions = 1.1.3, 1.6.22...

NPM: React Router: Unauthenticated Denial of Service via Inefficient Route Matching

NPM: React Router: Unauthenticated Denial of Service via Inefficient Route Matching vulnerability discovered by ? in WordPress Npm react-router versions = 7.0.0, 7.18.0...

NPM: LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

NPM: LiquidJS: pop filter bypasses memoryLimit accounting that its array-filter siblings enforce vulnerability discovered by ? in WordPress Npm liquidjs versions = 10.27.0...

NPM: electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

NPM: electron-updater: Cross-origin redirect leaks PRIVATE-TOKEN and mixed-case Authorization credentials in builder-util-runtime vulnerability discovered by ? in WordPress Npm builder-util-runtime versions 9.7.0...

NPM: electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

NPM: electron-updater: Uncontrolled search path elements within AppImage built by app-builder-lib vulnerability discovered by ? in WordPress Npm app-builder-lib versions 26.15.0...

WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Events Made Easy versions = 3.1.3...

WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Event Tickets versions = 5.29.0.1...

WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Visual Composer Website Builder versions = 45.15.0...

WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MapPress Maps for WordPress versions = 2.97.6...

WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Orbit Fox by ThemeIsle versions = 3.0.7...

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Denny Abraham Sinaga in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions = 4.5.11...

WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Product Feed Manager versions = 7.6.1...

WordPress ARforms plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam - Noventiq Vietnam in WordPress Plugin ARForms versions = 7.2.1...

WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BetterDocs versions = 4.6.2...

WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WordPress Social Login and Register versions = 7.8.0...

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AffiliateX versions = 2.3.5...

WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Abandoned Cart Lite for WooCommerce versions = 6.8.0...

WordPress SUMO Reward Points for WooCommerce plugin <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nguyen Cong Quang in WordPress Plugin SUMO Reward Points versions = 32.7.0...

WordPress FormCraft plugin <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam - Noventiq Vietnam in WordPress Plugin FormCraft 3 versions = 3.9.14...

WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.6 - Content Injection vulnerability

Content Injection vulnerability discovered by NosleeP++ in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.6...

WordPress AI Copilot – Content Generator plugin <= 1.5.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AIWU versions = 1.5.4...

WordPress Product Designer for WooCommerce WordPress | Lumise plugin <= 2.1.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by bashu - VN in WordPress Plugin Lumise Product Designer versions = 2.1.1...

WordPress MDJM Event Management plugin <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by moonge in WordPress Plugin Mobile DJ Manager versions = 1.7.8.4...

WordPress GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin <= 1.12.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin GoDAM versions = 1.12.2...

WordPress Customer Support Ticket System & Helpdesk plugin <= 6.0.5 - Unauthenticated Code Injection vulnerability

Unauthenticated Code Injection vulnerability discovered by theviper17y in WordPress Plugin WP Ticket Customer Service Software & Support Ticket System versions = 6.0.5...

WordPress WP Foodbakery plugin <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin FoodBakery versions = 4.9...

WordPress ProfileGrid plugin < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering vulnerability

Subscriber+ Cross-User Private Message Thread Deletion and Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ProfileGrid versions 5.9.9.7...

WordPress ProfileGrid plugin < 5.9.9.7 - Subscriber+ Premium License Tampering vulnerability

Subscriber+ Premium License Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ProfileGrid versions 5.9.9.7...