NPM: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

NPM: CodeWhale: Project config instructions override enables arbitrary file read into AI system prompt via cloned repository vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.8, 0.8.41...

NPM: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

NPM: CodeWhale: Project config instructions override enables arbitrary file read into AI system prompt via cloned repository vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.32, 0.8.41...

NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

WordPress Restaurant Menu and Food Ordering plugin < 2.4.12 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Restaurant Menu by MotoPress versions 2.4.12...

WordPress ePayco Payment Gateway for WooCommerce plugin < 8.4.7 - Unauthenticated Payment Confirmation Bypass vulnerability

Unauthenticated Payment Confirmation Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Epayco versions 8.4.7...

WordPress Pods plugin 3.3-3.3.9.1 - Author+ Arbitrary File Read vulnerability

Author+ Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Pods versions 3.3-3.3.9.1...

WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Plugin JetPopup versions = 2.0.20.2...

WordPress E-cab Taxi Booking Manager for Woocommerce plugin < 2.0.5 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Taxi Booking Manager for WooCommerce versions 2.0.5...

WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme WoodMart versions 8.3.8...

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad in WordPress Theme WP Rentals versions 3.16.0...

WordPress WooCommerce plugin <= 10.9.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce versions = 10.9.4...

WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin MarketKing versions = 2.1.60...

WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mySebbe in WordPress Plugin WCFM Membership versions = 2.11.11...

WordPress Divi Ajax Filter plugin <= 5.1.2 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by h0xilo in WordPress Plugin Divi Ajax Filter versions = 5.1.2...

WordPress LearnDash LMS plugin <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin LearnDash LMS versions = 5.1.5...

WordPress Xpro Addons — 140+ Widgets for Elementor plugin < 1.7.8 - Unauthenticated Draft/Private Product Disclosure vulnerability

Unauthenticated Draft/Private Product Disclosure vulnerability discovered by Moshe in WordPress Plugin Xpro Elementor Addons versions 1.7.8...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9 - Subscriber+ Arbitrary Post Meta Write vulnerability

Subscriber+ Arbitrary Post Meta Write vulnerability discovered by ryan zegar in WordPress Plugin Directorist versions 8.9...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.134 - Admin+ Arbitrary File Deletion vulnerability

Admin+ Arbitrary File Deletion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WPvivid Backup and Migration versions 0.9.134...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.134 - Admin+ File Write Outside the Backup Directory vulnerability

Admin+ File Write Outside the Backup Directory vulnerability discovered by reconnaissance in WordPress Plugin WPvivid Backup and Migration versions 0.9.134...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by cyberkareem in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

WordPress Ninja Forms plugin 3.14.0-3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability

Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability discovered by ChinhNguyen in WordPress Plugin Ninja Forms versions 3.14.0-3.15.1...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure vulnerability

Unauthenticated Order and Opt-In PII Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WPFunnels versions 3.13.0...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Aditya Gurav in WordPress Plugin WPFunnels versions 3.13.0...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending vulnerability

Unauthenticated Arbitrary Recipient Email Sending vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WPFunnels versions 3.13.0...

WordPress Hummingbird Performance plugin < 3.21.2 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Hummingbird versions 3.21.2...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated User Registration vulnerability

Unauthenticated User Registration vulnerability discovered by D01EXPLOIT OFFICIAL in WordPress Plugin WPFunnels versions 3.13.0...

WordPress Content Views plugin < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Content Views versions 4.5.1.2...

NPM: toml-node: Uncontrolled Recursion

NPM: toml-node: Uncontrolled Recursion vulnerability discovered by ? in WordPress Npm toml versions 4.2.0...

NPM: toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

NPM: toml-node: Prototype Pollution Leads to Object.prototype Corruption via proto Key-Path Desynchronization vulnerability discovered by ? in WordPress Npm toml versions 4.1.2...

NPM: Phoenix: Presence keys colliding with `Object.prototype` members break existence checks

NPM: Phoenix: Presence keys colliding with Object.prototype members break existence checks vulnerability discovered by ? in WordPress Npm phoenix versions = 1.2.0-rc.0, 1.5.15...

NPM: stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

NPM: stream-json: pick/ignore/filter/replace filters are Odepth² on nested input — small crafted JSON blocks the event loop for seconds→minutes DoS vulnerability discovered by ? in WordPress Npm stream-json versions = 3.4.0...

NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.17.5...

NPM: ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

NPM: ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.31.0...

NPM: Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

NPM: Claude Code Templates: Unauthenticated OS command injection RCE in Claude Code Studio server --studio vulnerability discovered by ? in WordPress Npm claude-code-templates versions = 1.29.2...

NPM: Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

NPM: Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

NPM: Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: Import-time RCE via schema default -> zod module-level template literal

NPM: Orval: Import-time RCE via schema default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: Import-time RCE via array-items default -> zod module-level template literal

NPM: Orval: Import-time RCE via array-items default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: Import-time RCE via header-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via header-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

NPM: Orval: RCE via schema property name - computed-property-key injection in the MSW mock generator vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: Import-time RCE via enum-typed default -> zod module-level template literal

NPM: Orval: Import-time RCE via enum-typed default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

NPM: Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

NPM: LiquidJS has an infinite loop vulnerability in its `strip_html` filter

NPM: LiquidJS has an infinite loop vulnerability in its striphtml filter discovered by ? in WordPress Npm liquidjs versions = 10.26.0, 10.27.1...

WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by ChinhNguyen in WordPress Plugin SureForms versions = 2.12.5...

WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.3...

WordPress KP Agent Ready plugin <= 1.1.99 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin KP Agent Ready versions = 1.1.99...

WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.5...

WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin SEOPress versions = 10.1...