WordPress < 7.0.3 - Multiple Contributor+ Stored XSS vulnerabilities

Multiple Contributor+ Stored XSS vulnerabilities discovered by Asaf Mozes, n05ec, Alex Concha in WordPress core versions 7.0.3...

NPM: node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

NPM: node-re2: Out-of-bounds heap read in replace/split via a Buffer ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript vulnerability discovered by ? in WordPress Npm re2 versions = 1.26.0...

NPM: node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

NPM: node-re2: String.prototype.replacere2, template aborts the Node process uncatchable ToLocalChecked on empty MaybeLocal when the result exceeds V8's max string length vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.0...

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 vulnerability discovered by ? in WordPress Npm ngx-extended-pdf-viewer versions = 27.0.0-rc.0, 29.0.0-rc.3...

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF vulnerability discovered by ? in WordPress Npm pdfjs-dist versions = 5.6.83, 6.2.108...

WordPress < 7.0.3 - Subscriber+ Site Creation vulnerability

Subscriber+ Site Creation vulnerability discovered by Aikido Security in WordPress core versions 7.0.3...

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution 3.x and 4.x — CVE-2026-59870 fix not backported vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.1...

NPM: Nx: Zip-Slip in the self-hosted remote cache

NPM: Nx: Zip-Slip in the self-hosted remote cache vulnerability discovered by ? in WordPress Npm nx versions = 20.8.0, 22.7.7...

NPM: Mermaid radar diagrams are vulnerable to DoS

NPM: Mermaid radar diagrams are vulnerable to DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 11.6.0, 11.16.1...

NPM: Mermaid configuration APIs allow prototype pollution

NPM: Mermaid configuration APIs allow prototype pollution vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

NPM: Mermaid Architecture diagrams are vulnerable to prototype pollution

NPM: Mermaid Architecture diagrams are vulnerable to prototype pollution vulnerability discovered by ? in WordPress Npm mermaid versions = 11.5.0, 11.16.1...

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 10.6.0, 10.9.8...

WordPress Core < 7.0.3 - Reflected XSS to RCE vulnerability

Reflected XSS to RCE vulnerability discovered by pwn.ai in WordPress core versions 7.0.3...

WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by luc in WordPress Plugin Simple Link Directory Pro versions = 15.0.8...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.43...

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP Full Stripe Free versions = 8.5.0...

WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Jamaal ahmed in WordPress Theme AI Hub versions = 1.3.10...

WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Agrion versions = 1.0.0...

WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme AI ANN versions = 1.29.0...

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agricola versions = 1.21.0...

WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agora versions = 1.9...

WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Advice versions = 1.18.0...

WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Adrena versions = 1.2.14...

WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Accalia versions = 1.5.3...

WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Abogado versions = 1.18...

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Abelle versions = 1.22...

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme A.Williams versions = 1.3.1...

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme 69 Clothing versions = 1.2.11.1...

WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dzeusking in WordPress Plugin WP Job Portal versions = 2.5.6...

WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by she11f in WordPress Plugin Login with phone number versions = 1.8.70...

WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LevinityCyber in WordPress Plugin Survey Maker versions = 5.2.3.3...

WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Houzez Property Feed versions = 2.5.48...

WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by Chiao-Lin, Yu Steven Meow in WordPress Plugin CAPTCHA 4WP versions = 7.6.0...

WordPress Simply Schedule Appointments plugin < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability

Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability discovered by Suleyman Huseynov in WordPress Plugin Simply Schedule Appointments versions 1.6.12.6...

WordPress Simple Restrict plugin < 1.2.9 - Contributor+ Restricted Content Disclosure vulnerability

Contributor+ Restricted Content Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Simple Restrict versions 1.2.9...

WordPress AI ChatBot for WooCommerce plugin < 4.8.4 - Unauthenticated Gemini API Key Abuse vulnerability

Unauthenticated Gemini API Key Abuse vulnerability discovered by Pedro Pinho in WordPress Plugin ChatBot for eCommerce WoowBot versions 4.8.4...

WordPress King Addons for Elementor plugin < 51.1.76 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by V1T in WordPress Plugin King Addons for Elementor versions 51.1.76...

WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability

Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.2...

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Theme My Login versions = 7.1.14...

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom CSS and JavaScript versions = 2.0.16...

WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plugins Garbage Collector Database Cleanup versions = 0.14...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

WordPress YOP Poll plugin 7.0.0-7.0.6 - Unauthenticated Vote Restriction Bypass vulnerability

Unauthenticated Vote Restriction Bypass vulnerability discovered by Melina Lentini M3l3n in WordPress Plugin YOP Poll versions 7.0.0-7.0.6...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin TranslatePress versions = 3.2.6...