NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.22...

NPM: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

NPM: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.18...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.13 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.8.13...

WordPress WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce plugin <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation vulnerability

Authenticated Shop Manager+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPify Woo Czech versions = 5.4.16...

WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Subscriber+ Path Traversal to Arbitrary File Read vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Checkout Field Editor for WooCommerce Pro versions = 3.7.7...

WordPress Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion vulnerability

Authenticated Subscriber+ Path Traversal to Arbitrary CSS/JS File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Nexter Blocks versions = 5.0.0...

WordPress StoreGrowth plugin <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Chawabhon Netisingha JNX03 in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions = 2.1.0...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.8.13...

WordPress Paid Memberships Pro plugin <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Paid Memberships Pro versions = 3.8.1...

WordPress Tablesome Table plugin < 1.1.31 - Unauthenticated Post Creation and Modification vulnerability

Unauthenticated Post Creation and Modification vulnerability discovered by Kim Dvash in WordPress Plugin Tablesome versions 1.1.31...

WordPress Database for Contact Form 7, WPforms, Elementor forms plugin < 1.5.3 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Luca Jungnickel in WordPress Plugin Contact Form Entries versions 1.5.3...

WordPress Quiz and Survey Master (QSM) plugin < 11.1.3 - Unauthenticated User Enumeration and Password Oracle vulnerability

Unauthenticated User Enumeration and Password Oracle vulnerability discovered by Ahmad Mubarak Alanazi in WordPress Plugin Quiz And Survey Master versions 11.1.3...

WordPress Online Scheduling and Appointment Booking System plugin < 27.8 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Jakub Herman in WordPress Plugin Bookly versions 27.8...

WordPress MotoPress Hotel Booking plugin < 6.0.4 - Subscriber+ Sensitive Data Disclosure vulnerability

Subscriber+ Sensitive Data Disclosure vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin Hotel Booking Lite versions 6.0.4...

WordPress Remote API plugin <= 0.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Pedro Pinho in WordPress Plugin Remote API versions = 0.2...

WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.4 - Unauthenticated Custom Icon Font Deletion vulnerability

Unauthenticated Custom Icon Font Deletion vulnerability discovered by Trần Tiến in WordPress Plugin Ultimate Addons for WPBakery Page Builder versions 3.21.4...

WordPress Booking Calendar Contact Form plugin <= 1.0.23 - Shortcode SQL Injection vulnerability

Shortcode SQL Injection vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions = 1.0.23...

WordPress Booking Calendar Contact Form plugin < 1.0.24 - Blind SQL Injection vulnerability

Blind SQL Injection vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions 1.0.24...

WordPress Simple Personal Message plugin <= 1.0.3 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Lenon Leite in WordPress Plugin Single Personal Message versions = 1.0.3...

WordPress Photocart Link plugin <= 1.6 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by CrashBandicot @DosPerl in WordPress Plugin Photocart Link versions = 1.6...

WordPress apptha-slider-gallery plugin <= 1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Ihsan Sencan in WordPress Plugin Apptha Slider Gallery versions = 1.0...

WordPress Backup Migration plugin <= 1.2.8 - Sensitive Information Exposure vulnerability

Sensitive Information Exposure vulnerability discovered by Wadeek in WordPress Plugin Backup Migration versions = 1.2.8...

WordPress Brandfolder plugin <= 3.0 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by AMAR^SHG in WordPress Plugin Brandfolder versions = 3.0...

WordPress WP with Spritz plugin <= 1.0 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Wadeek in WordPress Plugin WP with Spritz versions = 1.0...

WordPress Simple Backup plugin <= 2.7.11 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by PizzaHatHacker A gmail . com in WordPress Plugin Simple Backup versions = 2.7.11...

WordPress BuddyPress plugin <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Vincent Theriault-Laine in WordPress Plugin BuddyPress versions = 14.5.0...

WordPress Dharma Booking plugin <= 2.28.3 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by AMAR^SHG in WordPress Plugin Dharma Booking versions = 2.28.3...

WordPress Membership by Supsystic plugin <= 1.4.7 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Erik David Martin in WordPress Plugin Membership by Supsystic versions = 1.4.7...

WordPress product-catalog-8 plugin <= 1.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Lenon Leite in WordPress Plugin Product Catalog 8 versions = 1.2.0...

WordPress 404 SEO Redirection plugin <= 1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Ahmed Sherif Deloitte in WordPress Plugin 404 SEO Redirection versions = 1.0...

WordPress WP Google Review Slider plugin <= 6.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Princy Edward in WordPress Plugin WP Google Review Slider versions = 6.1...

WordPress BBS e-Franchise plugin < 1.1.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Lenon Leite in WordPress Plugin BBS e-Franchise versions 1.1.4...

WordPress WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin <= 1.5.7.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Mohin Paramasivam Shad0wQu35t in WordPress Plugin WordPress Survey & Poll versions = 1.5.7.3...

WordPress mwp-viral-signup plugin <= 2.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by TAD Group in WordPress Plugin Wow Viral Signups versions = 2.1...

WordPress Travel & Tours Meta Search plugin <= 2.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by CraCkEr in WordPress Plugin Flights & Hotels Booking WP Plugin versions = 2.3...

WordPress PICA Photo Gallery plugin <= 1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ihsan Sencan in WordPress Plugin PICA Photo Gallery versions = 1.0...

WordPress kittycatfish plugin <= 2.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by TAD Group in WordPress Plugin KittyCatfish versions = 2.2...

WordPress Car Park Booking System for WordPress plugin <= 1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by 8bitsec in WordPress Plugin Car Park Booking System for WordPress versions = 1.0...

WordPress FleekDash V2 plugin <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover vulnerability

Missing Authorization to Authenticated Subscriber+ Administrator Account Takeover vulnerability discovered by maru in WordPress Plugin FleekDash V2 versions = 2.6.2.2...

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ShopLentor Pro versions = 2.8.5...

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ShopLentor Pro versions = 2.8.5...

WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetSearch versions = 3.6.1.2...

WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetBlocks For Elementor versions = 1.5.0...

WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetReviews versions = 3.0.1...

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.18.0, = 2.17.4...

NPM: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

NPM: Jodit has cross-site scripting XSS via nested in SVG that bypasses clean-html sanitization vulnerability discovered by ? in WordPress Npm jodit versions 4.13.6...

NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier vulnerability discovered by ? in WordPress Npm jodit versions 4.12.28...

NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...