WordPress ChamaWP plugin < 1.0.13 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ChamaWP versions 1.0.13...

WordPress AcyMailing plugin < 10.11.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Pedro Pinho in WordPress Plugin AcyMailing SMTP Newsletter versions 10.11.1...

WordPress Mailmunch Forms for Mailchimp plugin <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover vulnerability

Missing Authorization to Authenticated Subscriber+ MailMunch Integration Takeover vulnerability discovered by t0ann9uy3n in WordPress Plugin MailChimp Forms by MailMunch versions = 3.2.7...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.9 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Nicolas Decayeux in WordPress Plugin JoomSport versions = 5.7.9...

WordPress Page and Post Restriction plugin <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure vulnerability

Unauthenticated Missing Authorization to Sensitive Information Exposure vulnerability discovered by Mitchell in WordPress Plugin Page Restriction WordPress WP versions = 1.4.1...

WordPress TableOn – WordPress Posts Table Filterable  plugin <= 1.0.5.1 - Unauthenticated Blind SQL Injection vulnerability

Unauthenticated Blind SQL Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin TableOn versions = 1.0.5.1...

WordPress wiseCampaign – WooCommerce Conversions Made Easy plugin <= 1.1.14 - Missing Authorization to Unauthenticated Plugin Configuration Modification vulnerability

Missing Authorization to Unauthenticated Plugin Configuration Modification vulnerability discovered by Legion Hunter in WordPress Plugin wiseCampaign versions = 1.1.14...

WordPress User Access Manager plugin <= 2.3.12 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin User Access Manager versions = 2.3.12...

WordPress Authora : Easy login with mobile number plugin < 1.7.7 - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover vulnerability

WordPress Authora : Easy login with mobile number plugin 1.7.7 - Easy Login with Mobile Number 1.7.7 - Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Authora : Easy login with mobile number versions 1.7.7...

WordPress Webinfos plugin <= 1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Webinfos versions = 1.2...

WordPress Huge IT Login plugin <= 1.0.4 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Login Social versions = 1.0.4...

WordPress POUCO Import Users plugin <= 1.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin POUCO Import Users versions = 1.0.0...

WordPress Lenxel WP theme <= 1.0.31 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Theme Lenxel WP versions = 1.0.31...

WordPress Support Genix plugin < 1.4.48 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Artus KG in WordPress Plugin Support Genix versions 1.4.48...

WordPress File Manager plugin 6.0-6.9 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion vulnerability

WordPress File Manager plugin 6.0-6.9 - 6.9 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Read and Deletion vulnerability discovered by daroo in WordPress Plugin Bit File Manager versions 6.0-6.9...

WordPress WPMU DEV Dashboard plugin <= 5.0.0 - Authentication Bypass to Arbitrary plugin Installation (Remote Code Execution) vulnerability

Authentication Bypass to Arbitrary plugin Installation Remote Code Execution vulnerability discovered by Austin Ginder in WordPress Plugin WPMU DEV Dashboard versions = 5.0.0...

WordPress Membership Plugin – Kadence Memberships plugin <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability

Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability discovered by scort in WordPress Plugin Restrict Content versions = 4.0.0...

WordPress FluentSMTP plugin <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Fraudless in WordPress Plugin FluentSMTP versions = 2.2.95...

WordPress Smart Popup by Supsystic plugin <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by daroo in WordPress Plugin Popup by Supsystic versions = 1.12.0...

NPM: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

NPM: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.4.0, 3.21.10...

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...

NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients vulnerability discovered by ? in WordPress Npm nuxt versions = 4.4.0, = 4.5.0...

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates incomplete fix for CVE-2026-53721 vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

NPM: Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

NPM: Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...

NPM: Electron: Sandboxed iframes can launch external protocol handlers

NPM: Electron: Sandboxed iframes can launch external protocol handlers vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: DevTools embedder handler executes arbitrary files via shell open

NPM: Electron: DevTools embedder handler executes arbitrary files via shell open vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

NPM: Electron: contextBridge object copy honors prototype setters

NPM: Electron: contextBridge object copy honors prototype setters vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

NPM: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

NPM: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter vulnerability discovered by ? in WordPress Npm electron versions 39.8.7...

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

WordPress Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by haofanjiukunle in WordPress Plugin Responsive Slider by MetaSlider versions = 3.111.0...

NPM: Electron: window.open features string controls some window options considered privileged

NPM: Electron: window.open features string controls some window options considered privileged vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session vulnerability discovered by ? in WordPress Npm electron versions = 40.0.0-alpha.1, 40.10.6...

NPM: Electron: HTTP redirect followed into local file loader

NPM: Electron: HTTP redirect followed into local file loader vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

NPM: Electron: Extension tab APIs operate across session boundaries

NPM: Electron: Extension tab APIs operate across session boundaries vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: shell.openPath path validation bypass via embedded null byte

NPM: Electron: shell.openPath path validation bypass via embedded null byte vulnerability discovered by ? in WordPress Npm electron versions 39.8.6...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

NPM: Electron: Cross-origin iframe can position native autofill popup

NPM: Electron: Cross-origin iframe can position native autofill popup vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin vulnerability discovered by ? in WordPress Npm electron versions 39.8.7...

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

NPM: Electron: Parent process code-sign check is spoofable

NPM: Electron: Parent process code-sign check is spoofable vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Ghost Content API filter bypass reveals private fields

NPM: Ghost Content API filter bypass reveals private fields vulnerability discovered by ? in WordPress Npm ghost versions = 5.46.1, 6.21.2...

NPM: Ghost: Cross-Site Scripting in Feature Image Captions

NPM: Ghost: Cross-Site Scripting in Feature Image Captions vulnerability discovered by ? in WordPress Npm ghost versions = 4.9.0, 6.54.1...

NPM: Ghost: Server-Side Request Forgery Mitigation Issue

NPM: Ghost: Server-Side Request Forgery Mitigation Issue vulnerability discovered by ? in WordPress Npm ghost versions = 6.26.0, 6.54.1...

WordPress Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin <= 6.11.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Instagram Feed versions = 6.11.3...

WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin <=5.0.2-<=5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Vendor+ Privilege Escalation vulnerability discovered by kai63001 in WordPress Plugin Dokan versions =5.0.2-=5.0.2...

WordPress Points and Rewards for WooCommerce plugin < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation vulnerability

Unauthenticated Arbitrary User Wallet & Points Manipulation vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin Points and Rewards for WooCommerce versions 2.10.1...

WordPress VikRentItems Flexible Rental Management System plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin VikRentItems Flexible Rental Management System versions = 1.2.1...

WordPress Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Views versions = 3.9.1...