WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Cyr to Lat reloaded – transliteration of links and file names versions = 1.3.3...

WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری versions = 4.4.5...

WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin TinyMCE Templates versions = 4.8.1...

WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom links in Elementor Image Carousel versions = 1.1.1...

WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Smart SEO Tool versions = 4.1.2...

WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Persian Woocommerce SMS versions = 7.2.2...

WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin TemplateSpare versions = 4.2.2...

WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Qubely versions = 1.8.14...

WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina versions = 3.1.12...

WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin BSK PDF Manager versions = 3.8...

WordPress LIQUID SPEECH BALLOON plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LIQUID SPEECH BALLOON versions = 1.2.6...

WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Visualizer versions = 4.0.1...

WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Civi Framework versions = 2.2.0...

WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Plugin Avada Custom Branding versions = 1.2...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Social Ninja versions = 4.3.0...

WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Accept Donations with PayPal & Stripe versions = 1.5.5...

WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Photo Gallery versions = 2.7.7.29...

WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Appointment Hour Booking versions = 1.5.86...

WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log versions = 5.6.4...

WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 43.2 - Cross-Site Request Forgery to Privilege Escalation vulnerability

Cross-Site Request Forgery to Privilege Escalation vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPO365 versions = 43.2...

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Broken Access Control vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by longnv719 in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Derrick Gilliland in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin Dokan Pro versions = 5.0.3...

WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...

WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Dokan Pro versions = 5.0.0...

NPM: n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

NPM: n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

NPM: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

NPM: n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: Next.js: Server-Side Request Forgery in Server Actions on custom servers

NPM: Next.js: Server-Side Request Forgery in Server Actions on custom servers vulnerability discovered by ? in WordPress Npm next versions = 14.1.1, 15.5.21...

NPM: Next.js: Cache confusion of response bodies for requests with bodies

NPM: Next.js: Cache confusion of response bodies for requests with bodies vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

NPM: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

NPM: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

NPM: Next.js: Unbounded Server Action payload in Edge runtime

NPM: Next.js: Unbounded Server Action payload in Edge runtime vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname vulnerability discovered by ? in WordPress Npm next versions = 12.0.0, 15.5.21...

NPM: Next.js: Denial of Service in the Image Optimization API using SVGs

NPM: Next.js: Denial of Service in the Image Optimization API using SVGs vulnerability discovered by ? in WordPress Npm next versions = 15.5.0, 15.5.21...

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.2.11...

NPM: Next.js: Denial of Service in App Router using Server Actions

NPM: Next.js: Denial of Service in App Router using Server Actions vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

NPM: n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook vulnerability discovered by ? in WordPress Npm n8n versions 2.27.4...

NPM: n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

NPM: n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

NPM: n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

NPM: n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

NPM: n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

NPM: n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads vulnerability discovered by ? in WordPress Npm n8n versions 1.123.58...

NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects vulnerability discovered by ? in WordPress Npm n8n versions 2.28.0...